new-api-usage

Query usage statistics and quota from a user-specified new-api endpoint. Use when the user asks to check API quota, usage records, token consumption, model-l...

This skill appears to do what it says: it will perform read-only GET requests to the base URL you provide and requires you to pass the API key explicitly. Before running it, make sure you trust the target base URL (don't pass keys to unknown servers). Prefer HTTPS and a server you control or trust because the script sends the key in both an Authorization header and as a query parameter — query parameters can be logged or leaked via referrers. If you want to reduce exposure, consider modifying the script to avoid sending the key in the URL query string (only use the Authorization header). Also review the printed output when using --json to ensure no sensitive fields are included (the script intentionally avoids printing the full key). Finally, be aware of a possible API-response handling quirk in print_quota (the script checks quota_data.get('code') in a way that may treat some valid responses as errors); this is a correctness issue, not evidence of malicious behavior.

Type: OpenClaw Skill Name: new-api-usage Version: 1.0.1 The skill bundle is designed to query usage statistics and quotas from a 'new-api' compatible endpoint. The Python script (scripts/query_usage.py) uses standard libraries to perform GET requests to user-provided URLs and includes logic to format and display the results. The documentation (SKILL.md) explicitly includes safety rules such as not printing API keys and requiring explicit user input for sensitive parameters, showing no signs of malicious intent or prompt injection.