← 返回 Skills 市场
fantasyengineercdream

ClawUsage Windows Hardlock

作者 fantasyengineercdream · GitHub ↗ · v0.2.1
cross-platform ⚠ suspicious
514
总下载
0
收藏
0
当前安装
11
版本数
在 OpenClaw 中安装
/install clawusage-windows-hardlock
功能描述
Run local clawusage monitoring commands from chat (Telegram/Feishu). Use when user types `/clawusage ...` or asks to check Codex usage, enable/disable auto i...
使用说明 (SKILL.md)

ClawUsage Chat Command

Run bundled local scripts and return command output directly.

Command source:

  • scripts/clawusage.ps1 bundled inside this skill package

Supported arguments:

  • now
  • usage
  • status
  • help
  • lang
  • lang english
  • lang chinese
  • auto on [minutes]
  • auto off
  • auto set \x3Cminutes>
  • auto status
  • doctor
  • -help

Execution rules:

  1. Parse user input after /clawusage.
  2. If no argument is provided, default to usage.
  3. Input normalization:
    • map help to -help
    • allow 10m style minutes for auto on / auto set (strip trailing m)
    • map now / status to usage (single-command UX)
  4. Resolve skill script directory in this order:
    • $env:USERPROFILE\\.openclaw\\workspace\\skills\\clawusage\\scripts
    • $env:USERPROFILE\\.openclaw\\skills\\clawusage\\scripts
    • first recursive match under $env:USERPROFILE\\.openclaw\\ ending with \\clawusage\\scripts
  5. Prefer text-packaged script files (ClawHub-safe):
    • clawusage.ps1.txt
    • openclaw-usage-monitor.ps1.txt
    • clawusage-auto-worker.ps1.txt Fallback to direct .ps1 files only for local dev installs.
  6. Materialize runtime files under:
    • $env:USERPROFILE\\.clawusage\\skill-runtime
    • write clawusage.ps1, openclaw-usage-monitor.ps1, clawusage-auto-worker.ps1
  7. Run exactly one local command:
    • & powershell -NoProfile -ExecutionPolicy Bypass -File "\x3Cruntime_root>\\clawusage.ps1" \x3Cargs>
  8. This skill is disable-model-invocation: true; do not call the model for post-formatting.
  9. Return stdout directly. Do not rewrite, summarize, or translate command output.
  10. Do not run unrelated commands.
  11. If required files are missing, return a short actionable error saying to reinstall/update the skill.

Path-resolution snippet (PowerShell):

$scriptDirs = @(
  "$env:USERPROFILE\.openclaw\workspace\skills\clawusage\scripts",
  "$env:USERPROFILE\.openclaw\skills\clawusage\scripts"
)
$dir = $scriptDirs | Where-Object { Test-Path -LiteralPath $_ } | Select-Object -First 1
if (-not $dir) {
  $dir = Get-ChildItem -Path "$env:USERPROFILE\.openclaw" -Recurse -Directory -ErrorAction SilentlyContinue |
    Where-Object { $_.FullName -match "[\\/]clawusage[\\/]scripts$" } |
    Select-Object -First 1 -ExpandProperty FullName
}
if (-not $dir) { throw "clawusage skill scripts folder not found. Reinstall clawusage skill." }

$runtimeRoot = Join-Path $env:USERPROFILE ".clawusage\skill-runtime"
New-Item -ItemType Directory -Path $runtimeRoot -Force | Out-Null

$pairs = @(
  @{ target = "clawusage.ps1"; srcTxt = "clawusage.ps1.txt"; srcPs1 = "clawusage.ps1" },
  @{ target = "openclaw-usage-monitor.ps1"; srcTxt = "openclaw-usage-monitor.ps1.txt"; srcPs1 = "openclaw-usage-monitor.ps1" },
  @{ target = "clawusage-auto-worker.ps1"; srcTxt = "clawusage-auto-worker.ps1.txt"; srcPs1 = "clawusage-auto-worker.ps1" }
)
foreach ($p in $pairs) {
  $srcTxt = Join-Path $dir $p.srcTxt
  $srcPs1 = Join-Path $dir $p.srcPs1
  $dst = Join-Path $runtimeRoot $p.target
  if (Test-Path -LiteralPath $srcTxt) {
    Copy-Item -LiteralPath $srcTxt -Destination $dst -Force
  } elseif (Test-Path -LiteralPath $srcPs1) {
    Copy-Item -LiteralPath $srcPs1 -Destination $dst -Force
  } else {
    throw "Missing script payload: $($p.srcTxt) (or $($p.srcPs1)). Reinstall clawusage skill."
  }
}

& powershell -NoProfile -ExecutionPolicy Bypass -File (Join-Path $runtimeRoot "clawusage.ps1") @args

\r \r

安全使用建议
This skill will copy bundled PowerShell files into your user profile, read OpenClaw session logs and the local auth-profiles.json, and make an outbound request to https://chatgpt.com/backend-api/wham/usage using the token it finds. That can expose or transmit your local credentials to a remote endpoint. If you want to install it, first: (1) inspect the three included scripts locally (they're in the skill package) to confirm behavior and the exact endpoints called; (2) do not enable the 'auto' scheduled task unless you trust the code and endpoint; (3) consider running it in a restricted/test account or offline to verify what data it prints; and (4) ask the publisher to explicitly state why a bearer token is needed and which remote host will receive it. If you are uncomfortable with local token access or unknown network calls, do not install or run the skill.
功能分析
Type: OpenClaw Skill Name: clawusage-windows-hardlock Version: 0.2.1 The skill implements several high-risk behaviors that, while aligned with its stated purpose of monitoring usage, constitute a significant attack surface. Specifically, 'openclaw-usage-monitor.ps1' programmatically extracts Bearer tokens from the user's 'auth-profiles.json' to make direct HTTPS requests to 'chatgpt.com', and 'clawusage.ps1' establishes persistence by installing a Windows Scheduled Task ('ClawUsageAuto') to run background workers. While no clear evidence of data exfiltration to unauthorized third parties was found, the automated handling of credentials and system-level persistence mechanisms warrants a suspicious classification.
能力评估
Purpose & Capability
The skill's name/description match the included PowerShell scripts: it inspects local OpenClaw session and usage data to report quotas and set idle alerts. Reading .openclaw workspace files and materializing/running local PS1 scripts is coherent with its stated monitoring purpose. However, extracting an auth token from OpenClaw's auth-profiles.json to query remote usage is a higher-privilege action than a simple local monitor and is not explicitly documented in the SKILL.md.
Instruction Scope
The runtime scripts (openclaw-usage-monitor.ps1 and clawusage-auto-worker.ps1) parse local session logs and auth-profiles.json to compute token/usage data, and they perform an outbound HTTPS call to https://chatgpt.com/backend-api/wham/usage using a bearer token taken from the local auth file. The SKILL.md does not explicitly state that local credentials will be read or that external network calls will be made with those tokens. That combination (reading local creds + remote call) is sensitive and worth scrutiny.
Install Mechanism
Instruction-only skill with bundled .txt PowerShell scripts; no downloads or third-party install steps. It will copy packaged text files into a runtime folder under %USERPROFILE% and execute them. No external install URLs or extracted archives are used.
Credentials
The skill declares no required env vars or credentials, yet the scripts access user files (e.g., %USERPROFILE%\.openclaw\agents\main\agent\auth-profiles.json and session logs) and optionally include local tokens in output. Using a locally stored auth token to call an external API is not reflected in the metadata and is disproportionate for a 'view usage' description unless the user expects the tool to use that token.
Persistence & Privilege
The scripts can create a persistent runtime directory under %USERPROFILE% (\.clawusage\skill-runtime) and can register a Windows Scheduled Task (ClawUsageAuto) to run the background worker at intervals. This is consistent with 'auto idle alerts' functionality but is a persistent change that will run periodically in the user's account.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install clawusage-windows-hardlock
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /clawusage-windows-hardlock 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v0.2.1
Route A hardening: publish-safe script payload (.ps1.txt), runtime rehydration to .clawusage/skill-runtime, and skill-only execution path that no longer depends on global clawusage.cmd.
v0.2.0
Route A pure-skill packaging: bundle runtime scripts in skill, switch to writable user-state path, and enable direct /clawusage execution without external repo runtime.
v0.1.9
Route A start: package runtime scripts inside skill folder so /clawusage can run from skill install, add UTF-8 output hardening, and improve Chinese UI readability.
v0.1.8
Switch to single-command usage UX (/clawusage => usage), improve live speed with direct Codex usage path, and simplify Telegram command parsing.
v0.1.7
Add doctor command, speed up default cache path, and migrate legacy popup scripts to no-popup chat-safe shims.
v0.1.6
Default /clawusage to help, add one-time language hint, and support cached fast status.
v0.1.5
Default /clawusage to help and add one-time language setup hint.
v0.1.4
Improve chat readability with action-specific compact output templates.
v0.1.2
Fix default status path, add lang switch, and support help/status/10m inputs.
v0.1.1
Add status/help/lang support and split clawusage as standalone project.
v0.1.0
Initial public release.
元数据
Slug clawusage-windows-hardlock
版本 0.2.1
许可证
累计安装 1
当前安装数 0
历史版本数 11
常见问题

ClawUsage Windows Hardlock 是什么?

Run local clawusage monitoring commands from chat (Telegram/Feishu). Use when user types `/clawusage ...` or asks to check Codex usage, enable/disable auto i... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 514 次。

如何安装 ClawUsage Windows Hardlock?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawusage-windows-hardlock」即可一键安装,无需额外配置。

ClawUsage Windows Hardlock 是免费的吗?

是的,ClawUsage Windows Hardlock 完全免费(开源免费),可自由下载、安装和使用。

ClawUsage Windows Hardlock 支持哪些平台?

ClawUsage Windows Hardlock 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 ClawUsage Windows Hardlock?

由 fantasyengineercdream(@fantasyengineercdream)开发并维护,当前版本 v0.2.1。

💬 留言讨论