TokFlow

Token 消耗监控与优化分析工具。查询 LLM 模型用量、费用、各渠道余额、提问方式分析与优化建议。当用户询问 token 消耗、模型费用、优化建议、渠道余额、提问方式优化等问题时使用此技能。

This skill is a thin client that calls a local TokFlow service on http://localhost:8001 to get token/usage reports and suggestions; the wrapper itself is low-risk (no external downloads, no env-vars requested), but the backend it depends on will have access to your OpenClaw session files and any provider credentials needed to check balances. Before installing or using: (1) confirm you actually have a trusted TokFlow backend running on localhost (or else the calls will fail); (2) inspect and trust the TokFlow backend code/config — it will read conversation logs and may store/provider API keys; (3) ensure provider credentials are stored securely and not exposed to untrusted services; (4) if you lack assurance about the backend, run this skill in an isolated/test environment or review the backend implementation first.

Type: OpenClaw Skill Name: tokflow Version: 0.5.0 The TokFlow skill is designed to query a local service running on `http://localhost:8001/api` for LLM token usage and optimization data. The `scripts/tokflow_query.py` script uses standard Python libraries (`urllib.request`, `json`) to make HTTP GET/POST requests to this local endpoint. User-provided arguments like `model_id` are properly URL-encoded using `urllib.parse.quote`, and numeric arguments like `days` are type-casted to integers, preventing injection vulnerabilities. There is no evidence of external network calls, file system manipulation, shell command execution of untrusted input, data exfiltration, persistence mechanisms, or malicious prompt injection attempts against the AI agent in `SKILL.md` or `README.md`. The skill's functionality is entirely confined to interacting with a presumed legitimate local service, aligning with its stated purpose.