MiniMax Token Plan Usage Monitor

MiniMax Token Plan 用量监控 — 专为云部署龙虾（OpenClaw）设计，自动查询本周/5小时窗口用量、套餐余量、剩余调用次数及重置时间。支持 QQ/Discord/Telegram 多通道通知，可配置告警阈值。触发词：minimax额度查询、token plan用量、本周用量、剩余次数、订阅状...

What to consider before installing: - Hard-coded secrets: The package contains hard-coded bearer tokens/session keys and a password-like string ('sym,1998'). If those tokens are valid in your environment they could be used to send messages or trigger model/agent sessions on your host. Treat these as high-risk — do not run this code unmodified. - Undocumented local API calls: Scripts call localhost:37701 (/tools/invoke and /v1/chat/completions) with Authorization and x-openclaw-session-key headers. SKILL.md does not document these tokens. Verify whether those endpoints and tokens are legitimate for your deployment; if not, do not install. - Inconsistencies: The skill metadata lists no required env vars but SKILL.md requires MINIMAX_PHONE and MINIMAX_PASSWORD. The code also writes logs under /root/.openclaw/workspace/bb/... and attempts to trigger a bb session via cron — these behaviors should be explicitly documented and justified. - Operational impact: Running the scripts requires Playwright/Chromium (heavy dependencies). The scripts simulate mouse movement and use stealth tooling — this is expected for scraping but increases attack surface. Recommended actions before using/installing: 1) Do not run these scripts as-is. Inspect and remove or replace any hard-coded tokens and credentials. Prefer reading tokens from a secure environment store or documented env vars. 2) Ask the skill author to explain why the bearer token and session key are embedded, and to remove them or make them configurable and optional. They should document exactly what local APIs are called and why. 3) If you must test, run it in an isolated environment (disconnected VM/container) and rotate any tokens that were embedded in the package if they were ever used. 4) Consider modifying cron_send to avoid instructing a bb session to execute filesystem paths; instead run the scraper directly via a safe scheduler and deliver notifications via documented, credentialed channels. 5) If you rely on OpenClaw local gateways, verify that the bearer tokens/session keys used in the package are not valid for your instance; if they are, revoke/rotate them immediately. If you want, I can list the exact lines/files with hard-coded tokens and produce a sanitized checklist of edits to make the package safe to run.

Type: OpenClaw Skill Name: minimax-token-plan-monitor Version: 1.2.1 The skill bundle contains multiple hardcoded sensitive credentials and authentication tokens, which is a significant security risk. Specifically, 'check_and_notify.js' and 'cron_send.js' include a hardcoded Bearer token (8d9c37620f26ffb66ec81daba1547ac537b6dee5aa0cc8fd), a specific session key, and a hardcoded password ('sym,1998'). While these currently target 'localhost' for local API interaction, the presence of static security artifacts in a distributed bundle is highly irregular and could be used to facilitate unauthorized access to the local OpenClaw gateway if the environment is not properly isolated.