Token Config Checker

批量检测 token / auth JSON 配置文件有效性，并可对 access token 做在线轻量探测，自动输出脱敏报告。适用于排查 Codex/OpenAI/OpenAI 兼容客户端导出的登录配置、会话凭据文件、token 缓存文件。支持把配置分为 valid / no_quota / invalid...

This tool largely does what it says (checks token JSONs and can probe tokens), but exercise caution before using the --probe option: the enhanced script will embed your access_token and account_id inside a JSON payload and POST it to the probe URL you supply (or to a panel-style endpoint), which means tokens can be transmitted off your machine. Notable red flags in the code: a hardcoded header Authorization: 'Bearer ab87036181' and a CODEX usage URL pointing to chatgpt.com — neither is explained in the README. Recommendations: - If you only need structural checks, run the scripts without --probe (offline checks). - If you must probe, only point --probe-url to services you fully control (local network or endpoints you administer). - Review the code lines mentioned (build_codex_panel_payload and online_probe_codex_panel) so you understand exactly what is sent to probe-url. - Consider running the script in an isolated environment (air-gapped VM or container) and monitor outbound network traffic before trusting it with sensitive token files. - If unsure, ask the provider/author to explain the hardcoded Authorization value and why codex panel payloads are sent in that form; absence of a clear justification is a risk indicator.

Type: OpenClaw Skill Name: token-config-checker Version: 1.1.4 The skill bundle contains scripts (check_token_configs.py and check_token_configs_plus.py) designed to recursively scan the filesystem for sensitive JSON files containing authentication tokens, session credentials, and 'Codex' configurations. While the stated purpose is validation, the scripts are designed to transmit these highly sensitive credentials to external endpoints, including support for third-party 'management panels' using hardcoded identifiers (e.g., authIndex 'dd2b5cfe06a6586b' and a static Bearer token 'ab87036181'). The inherent risk of automated credential discovery combined with the capability to send them to arbitrary or third-party URLs (via the --probe-url argument) presents a significant risk of credential exposure.