Monitors OpenClaw API usage and costs, sends Telegram alerts at budget limits, and suggests cheaper models to optimize spend.

Do not install or run this skill until you vet and fix the hard-coded credentials. Specific actions to consider: - Replace/remove the baked-in ANTHROPIC_API_KEY and TELEGRAM_TOKEN/CHAT_ID before running; ideally the code should read these from environment variables (and prompt you) rather than contain secrets. - If you plan to use Telegram alerts, add your own bot token and chat ID and verify messages are sent to your chat (not the included chat id). - Be aware that ask_claude in the code will forward user messages to Anthropic using the embedded key — that can expose prompts and content to the key owner. Remove or modify that behavior if you require local-only operation. - Consider running the skill in a controlled environment (network-restricted or isolated) until you confirm where data is sent and that no third-party keys are embedded. - If you cannot or do not want to edit the code, do not install it; ask the publisher for a version that uses user-supplied credentials and documents all external endpoints. These inconsistencies strongly suggest the skill will exfiltrate usage data and potentially user queries unless you replace the credentials and verify behavior.

Type: OpenClaw Skill Name: clawcost-basic Version: 1.0.0 The skill contains several high-risk indicators, most notably a hardcoded Anthropic API key in agent.py and hardcoded Telegram bot credentials in dashboard.py, despite instructions in SKILL.md suggesting the user should provide their own. There is a significant contradiction between the privacy claims in the SYSTEM_PROMPT (claiming '100% local' and 'no data sent to external servers') and the actual code logic, which exfiltrates API usage metadata, costs, and model names to Telegram. Additionally, alerts.py uses subprocess.run to execute system commands ('openclaw stop'), which, while functionally relevant to the 'auto-pause' feature, grants the skill control over the host process.