by 安全扫描
OpenClaw
安全
medium confidenceThe skill appears to do what it claims (query Baidu Qianfan Coding Plan usage and perform automated login via agent-browser) and its code matches the description; there are minor metadata/instruction inconsistencies to be aware of but no evidence of exfiltration or unrelated privileges.
评估建议
This skill appears to implement what it claims (query Qianfan usage and auto-login) and uses only the Baidu console API and a cookie file in your home directory. Before installing: (1) Confirm you are comfortable storing Baidu session cookies at ~/.baidu-qianfan-auth.json and that the cookie file has appropriate filesystem permissions. (2) Ensure agent-browser is installed from a trusted source (the scripts call it extensively); the package is listed as a dependency but the registry entry has no...详细分析 ▾
✓ 用途与能力
The name/description (query Qianfan usage and open console) align with the included Python scripts: they use saved cookies, call the Baidu Qianfan API endpoint, and implement an automated login flow via agent-browser. Required functionality (phone for SMS login, cookie storage) is consistent with the stated purpose.
ℹ 指令范围
SKILL.md and the scripts instruct the agent to read QIANFAN_PHONE (from env or prompt), open pages with agent-browser, capture snapshots, fill inputs, and save cookie state to ~/.baidu-qianfan-auth.json. Those actions are within scope for an auto-login/usage checker. Note: SKILL.md suggests putting QIANFAN_PHONE in ~/.openclaw/workspace/.env while code reads os.environ; the meta.json also marks QIANFAN_PHONE required — minor mismatch between documentation and code/registry metadata. The scripts only reference the user's home cookie file and the Baidu console API; they do not access other system paths or unrelated credentials.
ℹ 安装机制
There is no install spec in the registry entry (instruction-only), which is low-risk. However the documentation and _meta.json list agent-browser as a dependency and SKILL.md says 'agent-browser (auto install)'. Because no install mechanism is provided, agent-browser must already exist on the environment or be installed manually; this is an inconsistency in packaging/documentation but not an active risk in itself.
✓ 凭证需求
The only sensitive input required is a phone number for SMS-based login (QIANFAN_PHONE) and the scripts save/read a cookie file in the user's home. There are no requests for unrelated secrets (AWS keys, tokens, etc.). Storing and using cookies for authenticated requests is expected for this purpose. The registry-level 'Requirements' reported as 'none' (top summary) conflicts with _meta.json and SKILL.md which require QIANFAN_PHONE; this is a documentation/metadata mismatch to be aware of.
✓ 持久化与权限
The skill does save login state to ~/.baidu-qianfan-auth.json, which is normal for a login helper. It does not request always:true and does not modify other skills or system-wide agent settings. Autonomous invocation (disable-model-invocation=false) is the platform default; it is not flagged by itself.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/3/10
- Migrated main functionality from shell scripts to Python modules. - Added new Python files: check_quota_v2.py, qianfan.py, qianfan_usage.py. - Removed deprecated files: qianfan-usage.sh and qianfan_api.py. - README and documentation updated to reflect codebase changes.
● 无害
安装命令 点击复制
官方npx clawhub@latest install qianfan-usage
镜像加速npx clawhub@latest install qianfan-usage --registry https://cn.clawhub-mirror.com
技能文档
查询百度千帆 Coding Plan 用量和额度。
使用方法
/qianfan-usage # 自动登录并查询用量详情
/qianfan-usage --web # 打开百度千帆控制台
用量详情
查询 Coding Plan 的三级用量：
| 周期 | 说明 | 重置时间 |
|---|---|---|
| 5小时 | 短期用量 | 每5小时重置 |
| 周 | 周用量 | 每周一重置 |
| 月 | 月用量 | 套餐到期时重置 |
自动登录
脚本使用 agent-browser 自动登录百度账号：
- 手机号：从环境变量
QIANFAN_PHONE读取 - 验证码：需要手动输入（或等待短信）
配置
在 ~/.openclaw/workspace/.env 中设置手机号：
QIANFAN_PHONE=你的手机号
API 端点
GET https://console.bce.baidu.com/api/qianfan/charge/codingPlan/quota
返回格式：
{
"success": true,
"result": {
"quota": {
"fiveHour": { "used": 338, "limit": 1200, "resetAt": "..." },
"week": { "used": 499, "limit": 9000, "resetAt": "..." },
"month": { "used": 499, "limit": 18000, "resetAt": "..." }
}
}
}
依赖
- agent-browser（自动安装）
- Python 3
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制