Token Burn Monitor

Real-time token consumption monitoring dashboard for OpenClaw agents. Tracks per-agent token usage, cost breakdown by model, cache hit rates, cron job status...

Security Scan

The skill's files, runtime instructions, and requested filesystem access are coherent with a local token-usage dashboard for OpenClaw agents — nothing in the package appears disproportionate to that purpose, but the dashboard does read agent session files (which can contain user prompts) and will reveal them if you enable that option.

Purpose & Capability

Name/description promise (per-agent token/cost/cron monitoring) matches the code and SKILL.md: server.js scans an agents directory for session JSONL files, reads a cron jobs file, computes token/cost stats and serves a localhost-only dashboard. Declared filesystem reads (agents sessions and cron jobs) are expected for this purpose.

Instruction Scope

SKILL.md and server.js limit activity to local reads, serving a localhost-only GET API and static theme files. Important privacy note: session files can include user prompts; prompts are redacted by default but will be returned (up to 300 chars) if SHOW_PROMPTS or config.showPrompts is enabled. The instructions do not attempt to read unrelated system files or make outbound network requests.

Install Mechanism

No install spec; packaged as node scripts with start.sh/setup.sh. start.sh uses nohup node server.js and writes a PID/log to /tmp. No external downloads or package installs are performed by the provided scripts. Requires a Node.js runtime already present (documented).

Credentials

The skill does not request environment secrets and only references OPENCLAW_AGENTS_DIR, OPENCLAW_HOME and PORT (all appropriate for discovering sessions and cron data). The only sensitive data access is reading session JSONL files (explicit and justified by the dashboard purpose); the SKILL.md documents redaction behavior and opt-in for showing prompts.

Persistence & Privilege

The skill is not always-enabled and uses normal service scripts (start/stop) that affect only its own process and PID file; it does not modify other skills or global agent settings. Autonomous invocation (model invocation) is allowed by platform default but not combined with other concerning privileges here.

Assessment

This package is coherent for running a local token/cost dashboard, but consider the following before installing: (1) session JSONL files may contain sensitive user prompts — keep showPrompts disabled (default) unless you explicitly trust the machine and purpose; (2) inspect any custom themes you add before enabling them (themes are served to localhost and could display or fetch data if modified); (3) verify you have a trusted Node.js runtime and run it on a machine where local-only access is acceptable; (4) the published source/homepage are unknown in the registry metadata — if provenance matters, obtain the repository or author contact and verify integrity before production use.

Zero-dependency Node.js dashboard. Core API + swappable frontend themes.

Architecture

server.js          → Core API (stable, don't modify)
themes/default/    → Default dark dashboard theme
themes/<custom>/   → User/agent-generated themes
API.md             → API contract for theme developers
config.json        → Port, theme, agents, pricing overrides

Quick Start

bash start.sh            # Start (default port 3847)
bash start.sh status     # Check status
bash start.sh restart    # Restart after config change
bash start.sh stop       # Stop

Configuration

Copy config.default.json to config.json:

{
  "port": 3847,
  "theme": "default",
  "agents": {
    "main": { "name": "Karl", "icon": "/assets/karl.png" }
  },
  "modelPricing": {}
}

• theme: Directory name under themes/. Default: "default"
• agents: Display names/icons. Auto-discovered; config only overrides display.
• port: Also settable via PORT env var.
• modelPricing: Override/add model pricing ($/1M tokens).

Set OPENCLAW_AGENTS_DIR to override agent directory (default: /home/node/.openclaw/agents).

Themes

Themes live in themes/<name>/. Minimum: one index.html that fetches data from the API.

To create a custom theme:

1. Read API.md for all available endpoints
2. Create themes/my-theme/index.html
3. Set "theme": "my-theme" in config.json
4. Restart

The default theme (themes/default/) is a full reference implementation.

API Overview

All endpoints return JSON. GET-only. Server binds to localhost. Full docs in API.md.

Endpoint	Description
GET /api/config	Agent names and icons
GET /api/stats?date=	All agents aggregated
GET /api/agent/:id?date=	Single agent with per-call breakdown
GET /api/history?days=	30-day cost history
GET /api/pricing	Model pricing table
GET /api/crons	Scheduled jobs (read from filesystem)
GET /api/cron/:id/runs	Job run history

Security

• Server binds to 127.0.0.1 by default (localhost only)
• No shell execution — all data read from filesystem
• No outbound network requests — default theme uses system fonts
• User prompts redacted by default ([redacted]), opt-in via showPrompts: true in config
• HTML responses include CSP: connect-src 'self'; font-src 'self'
• GET-only — all other HTTP methods rejected

Troubleshooting

• No data: Verify OPENCLAW_AGENTS_DIR points to correct agents directory.
• Port conflict: PORT=4000 bash start.sh
• Theme not loading: Check themes/<name>/index.html exists.