Token Tracker

监控 OpenAI/其他模型 Token 消耗，支持每日/每周账单推送和超额警报

What to consider before installing: - Privacy: the hook reads ~/.openclaw/sessions/*.json and logs event.context to stdout; those logs (gateway logs) can contain conversation text and other sensitive metadata. If you run this skill, protect gateway logs and review what session status files contain. - External delivery: cron-config uses Telegram as a delivery channel. Ensure any automated report/alert destination is configured by you and that tokens/credentials for Telegram are not supplied to an untrusted skill. If you don't want automatic external delivery, do not install the cron jobs or set delivery to a safe internal channel. - Review and test in isolation: run the skill in a non-production user/account first to confirm it only records the intended fields. Inspect usage_records.json and config.json for stored data and remove/secure them as needed. - Code quality: the Node hook contains a coding bug (uses 'await import("fs")' inside a non-async function), and the hook prints full context — consider fixing the code to only extract token counts and model names and to avoid logging entire context. The Python script appears to work but uses a simplified timezone handling and will create files under ~/.openclaw/workspace/skills/token-tracker. - Trust and provenance: the skill has no homepage and an unknown source. If you do not trust the author, prefer manual inspection, run in an isolated environment, or avoid enabling the hook/cron features. - Operational: HOOK.md indicates Node is required. If you install the hook, ensure Node runs with expected module semantics (ESM) and that OpenClaw's hook registry will not forward sensitive data elsewhere.

Type: OpenClaw Skill Name: my-token-tracker Version: 1.0.0 The TokenTracker skill bundle is a legitimate utility designed to monitor and report LLM token usage within the OpenClaw environment. It consists of a Python script for data management, a Node.js hook (handler.js) for intercepting session events to log usage, and cron configurations for automated reporting. Analysis of the code shows no evidence of data exfiltration, unauthorized network access, or malicious prompt injection; all data processing occurs locally within the user's home directory (~/.openclaw). While the cron-config.json contains hardcoded Windows file paths (C:\Users\admin) and the hook contains futuristic model placeholders (e.g., GPT-5.4), these appear to be developer artifacts or configuration flaws rather than indicators of malicious intent.