Security audit
minimax-token-plan-monitor
Security checks for vulnerabilities and agentic risk
Overview
The skill largely matches a token-usage scraper but contains hardcoded account credentials and local gateway tokens, plus mismatches between the README and the code — these inconsistencies could lead to credential misuse or unexpected access to the host OpenClaw service.
What to consider before installing: - Do NOT assume the hardcoded values are harmless. The code includes an actual phone/password pair and a bearer token/session key that call localhost:37701. If those tokens are valid on your host, the skill can send messages and trigger local sessions without your further consent. - The SKILL.md claims credentials come from ~/.env but several scripts ignore that and use embedded credentials — this mismatch is suspicious. Ask the author to remove any hardcoded secrets and to make the script read only from explicit, documented config. - The skill uses Playwright/puppeteer with stealth plugins and a hardcoded Chromium path; installing it will pull large npm deps and require a browser — run in an isolated environment or container if you test it. - If you need this functionality: (1) request the author remove embedded credentials and tokens, (2) replace them with documented env vars only, (3) verify there are no hardcoded Authorization/Bearer values, and (4) run the code in a sandboxed user account with no access to production OpenClaw tokens. Rotate any local gateway tokens if you suspect they were leaked. - If you do not trust the source, avoid installing. The combination of hardcoded creds + local gateway calls is a real risk even though the scraping functionality itself is plausible. Confidence notes: assessment is based on the shipped source; I rated this 'suspicious' (not 'malicious') because the primary functionality (browser scraping) is coherent with the description — but the hardcoded credentials and local gateway tokens are unexplained and disproportionate, which warrants caution. Additional information that would raise confidence: author identity, explanation for embedded tokens, or a cleaned code release with all secrets removed and clear runtime env usage.
Static analysis
No suspicious patterns detected.