by 安全扫描
OpenClaw
可疑
medium confidence该技能基本如描述执行（查询 Z.AI 使用情况端点），但存在小的不一致性，特别是关于预期凭据和从浏览器存储提取会话 JWT 的指示，用户应在安装前验证。
评估建议
该技能主要用于监控 Z.AI 使用情况，但安装前请审查以下内容：- 验证凭据期望：README 和大多数脚本使用 ZAI_JWT_TOKEN（浏览器会话 JWT），但 scripts/check-usage.sh 参考 ZAI_API_KEY 并提供不同指导。请询问作者或更新/删除不匹配的脚本，以确保只提供预期的秘密。- 将 JWT视为敏感凭据：从浏览器 localStorage 复制令牌可以授予访问您的帐户的权限。仅将其存储在安全文件（例如 ~/.openclaw/secrets/zai.env）中，设置文件权限为 600，并避免将其提交到 git。- 尽可能使用最低权限/短期凭据。如果 Z.AI 提供具有有限范围或过期机制的 API 密钥机制，请使用它而不是完整的会话 JWT。- 确认网络行为：脚本仅调用 https://api.z.ai/api/monitor/usage/quota/limit。如果您在未来更新中看到其他端点，请仔细审查它们。- 如果您不舒服从浏览器存储提取令牌，请联系 Z.AI 支持或检查他们是否提供官方 API 密钥或 OAuth 流用于监控使用情况。鉴于凭...详细分析 ▾
ℹ 用途与能力
The scripts and documentation all target Z.AI usage monitoring and call a single API endpoint (https://api.z.ai/api/monitor/usage/quota/limit), which is consistent with the skill description. However, one script (scripts/check-usage.sh) expects a variable named ZAI_API_KEY and suggests retrieving a key from /dashboard, while the README/SKILL.md and the other scripts use ZAI_JWT_TOKEN taken from browser localStorage. This mismatch is unexplained and unnecessary for the described purpose.
ℹ 指令范围
Runtime instructions confine activity to reading a locally-stored token and calling the Z.AI API. The SKILL.md explicitly instructs the user to copy a JWT from browser DevTools (localStorage key z-ai-open-platform-token-production) — a sensitive operation but relevant to the stated task. The scripts search multiple local locations for the token (~/.openclaw/secrets/zai.env, SKILL_DIR/.env, ~/.zai.env, environment), which increases convenience but also broadens where the secret may be stored.
✓ 安装机制
There is no install spec and no remote downloads. The skill is instruction-only with local shell scripts; nothing in the manifest causes arbitrary code to be fetched or executed at install time.
⚠ 凭证需求
The only secret the skill uses is a bearer token (JWT) for the Z.AI API, which is proportionate for a usage-monitoring tool. However, the aforementioned inconsistency between ZAI_JWT_TOKEN vs ZAI_API_KEY is suspicious: one script requires a differently-named credential and suggests a different retrieval path. Also, the skill instructs the user to extract a session JWT from browser localStorage — this token can grant account access and should be handled carefully. The skill reads secrets from multiple local paths, which is convenient but increases exposure if those files are not secured.
✓ 持久化与权限
The skill does not request always:true, does not modify system-wide settings, and does not require any special persistent privileges. It only reads locally stored secrets and calls the Z.AI API.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.02026/2/27
改进文档，增强错误处理，支持多令牌位置
● 无害
安装命令 点击复制
官方npx clawhub@latest install zai-usage
镜像加速npx clawhub@latest install zai-usage --registry https://cn.clawhub-mirror.com
技能文档
监控您的 Z.AI GLM 编码计划使用情况实时。## 快速开始
# 检查使用情况
~/.openclaw/skills/zai-usage/scripts/usage-summary.sh
# 快速状态检查
~/.openclaw/skills/zai-usage/scripts/quick-check.sh
设置
- 从 https://z.ai/manage-apikey/subscription 获取您的 JWT 令牌
z-ai-open-platform-token-production
- 将其存储在
~/.openclaw/secrets/zai.env中：
ZAI_JWT_TOKEN=eyJhbGci...
查看内容
- 5 小时配额
- 月度配额
- Web 工具
- 计划级别
状态图标
| 图标 | 使用情况 |
|---|---|
| ✅ | < 50% |
| ⚠️ | 50-80% |
| 🔴 | > 80% |
- “我们的 Z.AI 使用情况如何？”
- “检查信用使用情况”
- “我们是否信用不足？”
要求
curl- HTTP 请求jq- JSON 解析bc- 数字格式化（可选）
源
- https://github.com/zereraz/tokensight
- https://www.reddit.com/r/ZaiGLM/comments/1pmb7fj/how_to_check_zai_coding_usage/
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制