Zai Usage

Monitor Z.AI GLM Coding Plan usage and quota limits. Track token consumption, view reset times, and check subscription status.

This skill is mostly coherent for monitoring Z.AI usage, but review the following before installing: - Verify credential expectations: README and most scripts use ZAI_JWT_TOKEN (a browser session JWT), but scripts/check-usage.sh references ZAI_API_KEY and different guidance. Ask the author or update/remove the mismatched script to ensure you only provide the intended secret. - Treat the JWT as a sensitive credential: copying a token from browser localStorage can grant access to your account. Only store it in a secure file (e.g., ~/.openclaw/secrets/zai.env) with file permissions set to 600 and avoid committing it to git. - Prefer using least-privilege / short-lived credentials where possible. If Z.AI provides an API key mechanism with limited scope or expiration, use that instead of a full session JWT. - Confirm network behavior: the scripts only call https://api.z.ai/api/monitor/usage/quota/limit. If you see any other endpoints in future updates, review them carefully. - If you are uncomfortable extracting tokens from browser storage, contact Z.AI support or check whether they provide an official API key or OAuth flow for monitoring usage. Given the credential-name mismatch and the sensitive nature of the JWT extraction step, proceed only after resolving the inconsistency and ensuring secure handling of the token.

Type: OpenClaw Skill Name: zai-usage Version: 1.1.0 The skill bundle is designed to monitor Z.AI usage and quotas. All scripts (`check-usage.sh`, `quick-check.sh`, `usage-summary.sh`) interact with the legitimate `https://api.z.ai` endpoint using a JWT token. The `SKILL.md` and `README.md` files provide clear, non-malicious instructions for setup and usage, explicitly guiding users to store the token securely in `~/.openclaw/secrets/zai.env`. While `scripts/usage-summary.sh` includes a `load_token` function that checks additional, less secure locations (`$SKILL_DIR/.env`, `~/.zai.env`) as fallbacks, this is a minor vulnerability (potential for insecure user choice) rather than malicious intent, as the documentation correctly advises the secure path, and the script does not exploit these locations or exfiltrate data. There is no evidence of data exfiltration, malicious execution, persistence, prompt injection, or obfuscation.