API Credit Health Bar Lite

Display API credit balances for 5 core providers (Anthropic, OpenAI, OpenRouter, Mistral, Groq) with video game style health bars. API auto-checks and manual...

Security Scan

The skill's code, optional environment variables, and runtime instructions are consistent with its stated purpose of showing and tracking API credit balances; nothing in the files indicates unexplained access or hidden endpoints.

Purpose & Capability

Name/description (API credit health bars) align with contained scripts: reading/writing a local config.json, rendering health bars, manual sync, and optional API auto-checks for OpenAI, OpenRouter, and Vercel. The optional env vars in SKILL.md (OPENAI_API_KEY, OPENROUTER_API_KEY, VERCEL_AI_GATEWAY_KEY) match the providers the code can query.

Instruction Scope

SKILL.md and scripts instruct only local config reads/writes and requests to official provider endpoints. One minor inconsistency: check_openai.py comments say it requires an "organization admin API key", while SECURITY.md recommends using project-level or minimal-privilege keys; this is a documentation/conflict note rather than evidence of exfiltration. Scripts run other local scripts via subprocess (expected for this tool).

Install Mechanism

No install spec: this is instruction/code-only and runs as local Python scripts. No remote downloads or extract steps, and no unusual install actions observed.

Credentials

The only environment access requested is optional API keys for the providers the skill actually queries. Keys are read from environment variables (not stored). The only concern is the check_openai.py docstring suggesting an org-admin key for billing access; that elevates privilege requirements for the OpenAI check and conflicts with the SECURITY.md guidance to prefer minimal-privilege keys.

Persistence & Privilege

Skill is not marked always:true and does not request system-wide persistence. It only writes a local config.json inside the skill directory and does not modify other skills or global settings.

Assessment

This skill appears to do exactly what it says: local config-based health bars plus optional API checks for OpenAI, OpenRouter, and Vercel. Before installing or running: 1) Prefer manual-sync mode if you want zero network access (do not set any API env vars). 2) If you enable auto-checks, set only minimal-privilege or billing-scoped API keys where possible — avoid handing highly privileged org-admin keys unless you understand the billing API requirements. 3) Keep config.json permissioned (e.g., chmod 600) and do not store keys in files. 4) Review the check_openai.py note about requiring an org admin key — if you cannot get a minimally privileged key that returns billing info, use manual sync instead. 5) The repository contains duplicated scripts in root and scripts/ — expected for packaging but you can inspect files locally before running. If you need higher assurance, run the scripts in a disposable environment or review/execute them line-by-line to confirm network targets and no surprising behavior.

API Credits Lite

Use this skill when the user asks about API credits, balances, spending, or wants to update their credit info for Anthropic, OpenAI, OpenRouter, Mistral, or Groq.

When to Use

✅ USE this skill when the user asks:

• "How much credit do I have left?" / "What's my balance?"
• "Show my API credits" / "Check my credits"
• "Update my [provider] balance to $X"
• "I topped up [provider] by $X"
• "Am I running low on [provider]?"

❌ DON'T use when:

• The user needs 16+ providers, JSONL auto-tracking, cloud SDKs, or heartbeat integration → use api-credits-pro

How to Use

You run the scripts internally — the user never types python3. Respond naturally and present health bar output conversationally.

The skill root is at: ~/.openclaw/workspace/skills/api-credits-lite/ Run scripts with: python3 <skill-root>/scripts/<script>.py <args>

---

Show Credit Balances

Triggers: "show my credits", "how much do I have left", "check my API balance"

python3 scripts/show_credits.py

Displays retro health bars for all configured providers. Colors: 🟩 >75% · 🟨 50–75% · 🟧 25–50% · 🟥 <25%

---

Manual Balance Sync

Triggers: "set my Anthropic balance to $X", "update my OpenAI credits to $X", "I have $X left on [provider]"

python3 scripts/sync_provider.py <provider> <balance>
# With max:  python3 scripts/sync_provider.py <provider> <balance> <max_credits>

# Examples:
python3 scripts/sync_provider.py anthropic 22.97
python3 scripts/sync_provider.py openai 95.00 100.00

Supported providers: anthropic, openai, openrouter, mistral, groq

Where to find balances:

• Anthropic → console.anthropic.com
• OpenAI → platform.openai.com/usage
• OpenRouter → openrouter.ai/activity
• Mistral → console.mistral.ai/billing
• Groq → console.groq.com/settings/billing

---

Auto-Check Balance via API

Triggers: "check my OpenAI balance automatically", "pull my OpenRouter credits"

For providers that expose a balance API (requires the relevant API key set as an env var):

python3 scripts/check_openai.py       # uses OPENAI_API_KEY
python3 scripts/check_openrouter.py   # uses OPENROUTER_API_KEY
python3 scripts/check_vercel.py       # uses VERCEL_AI_GATEWAY_KEY

Anthropic, Mistral, and Groq don't have public balance APIs — use manual sync for those.

---

Record a Top-Up

Triggers: "I added $X to my [provider] account", "I topped up $50 on OpenRouter"

python3 scripts/topup.py <provider> <amount>
# Example: python3 scripts/topup.py openrouter 20.00

---

Troubleshooting

If the display shows no providers, the config may be empty. Tell the user to run the first manual sync for each provider they use, or copy the example config:

cp config.example.json config.json

---

Upgrading

Need 16+ providers, auto-tracking from session logs, cloud SDKs (AWS/Azure/GCP), or heartbeat integration? Suggest api-credits-pro.