OpenClaw Usage Manager

Monitors dual Claude Max accounts' 5h/7d usage, shows real-time dashboard, and auto-switches when utilization exceeds 80%.

What to check before installing: - Inspect the repository your install will clone (the SKILL.md references a GitHub URL). Confirm the code matches what you were shown. - Understand token handling: the tool requires two Anthropic API tokens. You can use 1Password (recommended) or tokens.json (plaintext on disk). Prefer 1Password; if you use tokens.json, keep it chmod 600 and ensure the machine is trusted. - Backup ~/.openclaw/agents/main/agent/auth-profiles.json before running the auto-switcher. The checker overwrites that file to swap tokens; if misconfigured it could lock your agent or expose credentials. - Confirm dependencies: Node.js >=18 is required and the dashboard uses the 1Password CLI ('op') if you choose that setup path. The registry metadata did not declare these — the omission is a red flag. - Run the dashboard and scripts locally (not on a production machine) first and review network activity (they call api.anthropic.com and run local commands like lsof/kill). The dashboard is designed to bind to localhost only, but verify that behavior in your environment. - If you are not comfortable having a tool rewrite OpenClaw agent auth files, do not install. Consider manual switching or a version that only reads usage and reports but does not alter agent configuration. - If you decide to proceed: inspect setup scripts (setup-tokens.sh / setup-tokens-simple.sh), review how tokens are passed to child processes, and ensure your 1Password CLI is logged in and secure. Keep a copy of the original auth-profiles.json and restrict file permissions.

Type: OpenClaw Skill Name: openclaw-usage-manager Version: 1.1.0 The bundle provides a dashboard and auto-switching utility for managing multiple Anthropic accounts within OpenClaw by monitoring usage headers and updating the 'auth-profiles.json' configuration. While it performs high-risk operations such as modifying authentication tokens and executing shell commands (via execSync in server.mjs for 1Password CLI and process management), these actions are strictly aligned with its stated purpose. The implementation includes proactive security measures such as CSRF protection, host/origin validation for the local dashboard, atomic file writes, and restrictive file permissions (chmod 600) for token storage. No evidence of data exfiltration or malicious intent was found.