OpenClaw Token Monitor

OpenClaw Token 实时监控面板。支持：(1) SQLite 持久化存储历史数据 (2) 实时监控当前 Token 消耗（增量曲线） (3) 历史视图查看任意一天的消耗 (4) 按日/时会话汇总 (5) 人民币费用估算（MiniMax 官方定价） (6) 滚轮缩放 X 轴 (7) 图表采样防卡顿。触发场...

This skill appears to implement a local token-usage dashboard by calling the 'openclaw' CLI and saving snapshots to a local SQLite file. Before installing, consider: (1) The Node script requires '/tmp/node_modules/sql.js' via absolute path — ask the author why and ensure the runtime provides sql.js or modify the require to use a normal dependency. (2) The monitor persists session_key and per-session details in workspace/data/token_history.db — these can contain sensitive tokens/IDs; inspect that file and rotate any secrets if exposed. (3) The server listens on port 3000 and SKILL.md references a LAN IP; run it bound to localhost (or behind an authenticated proxy) and/or firewall the port if you don't want LAN access. (4) Verify the 'openclaw' CLI is legitimate and does not itself leak credentials. (5) Because part of the source was truncated in the package listing, review the full token-monitor.js for any outbound network calls or hidden endpoints before running. If you cannot audit or fix the absolute sql.js path and restrict the server, run the tool inside an isolated container/VM and limit filesystem/network exposure.

Type: OpenClaw Skill Name: openclaw-token-monitor Version: 1.2.0 The skill provides a token monitoring dashboard that utilizes high-risk capabilities such as shell command execution (via `execFile` calling `openclaw`), network service hosting (`http.createServer` on `0.0.0.0:3000`), and file system persistence for a SQLite database. While these features are aligned with the stated purpose, the code contains several critical vulnerabilities: the `/api/daily` endpoint is susceptible to SQL injection through the `date` parameter, and the frontend dashboard is vulnerable to XSS as it renders session data without proper sanitization. Additionally, the script relies on an unusual dependency path (`/tmp/node_modules/sql.js`) and hardcodes a specific local IP address (`192.168.50.210`) in its documentation, which may indicate a poorly secured or environment-specific implementation.