Termux Zero Token

在 Termux 上利用手機 Chrome 已登入的 cookies 免費調用 DeepSeek、Kimi、Qwen、GLM 等多款 AI 模型。

This skill does what it claims (uses ADB/Chrome remote debugging to steal cookies from your phone and reuse them to call AI services), but that capability is sensitive and risky. Before installing or running it, consider: 1) Only use on a device/account you fully control and that has no payment or sensitive data; these cookies can allow account takeover. 2) Review the code yourself (or have a trusted reviewer) — it saves cookies unencrypted to ~/.openclaw/zero-token/credentials.json for 7 days. 3) Running npm install will fetch playwright-core and its dependencies; be prepared for large installs and platform dependencies. 4) This approach likely violates the providers' terms of service and could lead to account suspension. 5) If you still want to try it, run it in an isolated environment (throwaway account / VM), remove stored credentials after use, and monitor network activity. 6) If you need legitimate API access, prefer official API keys or provider-approved SDKs rather than extracting browser sessions. Finally, given the sensitive nature of what it does, treat this skill as high-risk and avoid using it on primary or shared accounts.

Type: OpenClaw Skill Name: termux-zero-token Version: 1.0.0 The skill bundle automates the extraction of sensitive session cookies from a phone's Chrome browser via ADB and Chrome DevTools Protocol (CDP) to bypass AI provider API limits. While the code in src/index.ts and the provider scripts (e.g., src/providers/deepseek-stream.ts) appears to use these credentials locally to communicate with official AI endpoints like api.deepseek.com and api.moonshot.cn, the practice of scraping and storing raw session cookies in ~/.openclaw/zero-token/credentials.json is high-risk. Although no evidence of exfiltration to a third party was found, the tool's core functionality relies on bypassing security boundaries and Terms of Service, which is inherently risky behavior.