API配额监控与手动切换

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is coherent and matches its stated purpose, but users should know it can read OpenClaw session/config files, change the default model, and restart the Gateway when invoked.

This skill appears purpose-aligned, but treat model switching as an operational change: approve switching only when you are comfortable changing the default model and restarting the OpenClaw Gateway. Check the target model, know how to revert, and only enable the optional cron job if you want ongoing scheduled checks.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the switch command can temporarily stop or restart the local OpenClaw Gateway.

Why it was flagged

The script kills and restarts the OpenClaw Gateway as part of model switching. This is disclosed in SKILL.md and fits the purpose, but it can interrupt service if run at the wrong time.

Skill content
subprocess.run(["pkill", "-f", "openclaw-gateway"], capture_output=True)
Recommendation

Only approve --confirm or --model when you are ready for a Gateway restart, preferably outside important active sessions.

What this means

After switching, future OpenClaw requests may use a different model/provider than before.

Why it was flagged

The script modifies the OpenClaw configuration to change the default primary model. This is the advertised function, but it affects future agent/model routing.

Skill content
config["agents"]["defaults"]["model"]["primary"] = model
Recommendation

Confirm the target model/provider before switching, and keep a backup or note of the previous model if you may want to revert.

What this means

The skill may inspect local OpenClaw session status/error data to decide whether a model switch is advisable.

Why it was flagged

The script reads OpenClaw session state to count recent errors and quota/rate-limit signals. It appears scoped and does not transmit the data, but session files can contain sensitive operational context.

Skill content
SESSIONS_FILE = os.path.expanduser(os.environ.get("OPENCLAW_DIR", "~/.openclaw") + "/agents/main/sessions/sessions.json")
Recommendation

Use it only on OpenClaw profiles where reading recent session error metadata is acceptable.

What this means

Installation metadata may not fully prepare users for the local tools and permissions needed.

Why it was flagged

The registry requirements do not declare local dependencies/config paths, while SKILL.md and the script require Python, OpenClaw configuration access, and Gateway restart commands. This is under-declared but the behavior is disclosed in the artifacts.

Skill content
Required binaries (all must exist): none; Required config paths: none
Recommendation

Before use, verify Python 3, the OpenClaw CLI/Gateway, and access to ~/.openclaw/openclaw.json are available.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

If you add the cron job, the monitor will keep running periodically and writing logs.

Why it was flagged

The documentation includes an optional cron-based recurring check. It only runs --check rather than switching models, and it is user-directed, but it is still a persistent scheduled action.

Skill content
*/30 * * * * cd $HOME/.openclaw/skills/api-monitor && python3 api_monitor.py --check >> /var/log/api-monitor.log 2>&1
Recommendation

Only add the cron entry if you want recurring monitoring, and remove it from crontab when no longer needed.