Telegram Usage Stats

Display session usage statistics (quota, session time, tokens, context)

This skill appears to implement the advertised feature (showing quota, tokens, context) and its code is readable, but there are a few things to check before installing: - Missing declared dependency: handler.js executes 'clawdbot models status' but the skill metadata only lists 'node'. Ensure the 'clawdbot' CLI is present and trusted on your system. - Hardcoded paths: SKILL.md and README suggest running node against an absolute path (/home/drew-server/...), which will likely be wrong on your machine. Install location or invocation may need adjustment. - Sensitive local reads/writes: the skill reads ~/.clawdbot/agents/.../sessions/sessions.json and transcript JSONL files and will create/update ~/.clawdbot/quota-tracker.json. Those session/transcript files can include metadata or conversation-derived data; review them first and ensure you're comfortable with the skill reading that data. - No network exfiltration observed, but if you plan to expose reports to Telegram, confirm where tokens/IDs are stored and that the bot token is kept secure (the code does not read a bot token automatically; config-example shows how a token might be configured elsewhere). Recommended steps: 1) Inspect the two JS files locally (handler.js, session-reader.js) yourself (they are included in the bundle) to confirm behavior. 2) Run the handler in JSON mode in a safe environment: node handler.js json — review exactly what data is printed before connecting the skill to Telegram. 3) Backup ~/.clawdbot before first run and check file permissions (quota-tracker.json will be created/updated). 4) If you do not want the skill to read transcripts or session files, request a version that only reads non-sensitive aggregated metrics or provide a sandboxed copy of the session store. Because the source is 'unknown' and the package omits the implicit 'clawdbot' binary requirement and uses hardcoded paths, I rate this suspicious (medium confidence) rather than outright benign. If you can confirm the provenance and are comfortable with it reading ~/.clawdbot, the mismatches are explainable and the risk is lower.

Type: OpenClaw Skill Name: telegram-usage Version: 1.0.1 The skill is designed to display session usage statistics. It uses `child_process.execSync` in `handler.js` to execute the `clawdbot models status` command, which is a legitimate interaction with the host system's `clawdbot` CLI for its stated purpose. It also reads and writes files within the `~/.clawdbot` directory (`quota-tracker.json`, `sessions.json`, `*.jsonl`) to gather and store session-related data, which is necessary for its functionality. There is no evidence of data exfiltration, malicious execution, persistence, or prompt injection attempts in `SKILL.md` or other files. All actions are aligned with the skill's described purpose.