AI Token消耗监控

• Risk level: Low
• Analyzed: Apr 14, 2026, 10:58 PM
• Findings: 0
• Version: 1.0.2

Overview

The skill's code and instructions are consistent with its stated purpose: it reads local session logs to compute token usage, writes aggregated stats to the user's workspace, and does not request credentials or perform network exfiltration.

This skill appears to do what it claims: analyze local session logs and save aggregated token-usage JSON files. Before installing, consider: (1) the script will read your session files (~/.qclaw/agents/main/sessions) which may contain message contents—if those messages include sensitive data you may prefer not to run it or to inspect the script first; (2) it writes aggregated stats under ~/.qclaw/workspace/memory; ensure you are comfortable with that storage location; (3) it requires a local Python runtime to execute; (4) although no network calls are present, review the code if you want extra assurance. If you do not want the skill invoked autonomously, disable autonomous invocation in your agent settings.