Zai Usage

• Analyzed: May 11, 2026, 4:51 AM
• Findings: 1
• Version: 1.1.0
• Hash: 475e705df730177d8484a888030e2313473e2f33413a7aed2f76128105d0a66a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed to monitor Z.AI usage and quotas. All scripts (`check-usage.sh`, `quick-check.sh`, `usage-summary.sh`) interact with the legitimate `https://api.z.ai` endpoint using a JWT token. The `SKILL.md` and `README.md` files provide clear, non-malicious instructions for setup and usage, explicitly guiding users to store the token securely in `~/.openclaw/secrets/zai.env`. While `scripts/usage-summary.sh` includes a `load_token` function that checks additional, less secure locations (`$SKILL_DIR/.env`, `~/.zai.env`) as fallbacks, this is a minor vulnerability (potential for insecure user choice) rather than malicious intent, as the documentation correctly advises the secure path, and the script does not exploit these locations or exfiltrate data. There is no evidence of data exfiltration, malicious execution, persistence, prompt injection, or obfuscation.