Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Huo15 Cost Tracker

v1.1.2

火一五成本追踪器 - 追踪 AI API 使用量、Token 消耗和成本计算。支持 MiniMax、OpenAI 等模型。触发词:成本追踪、火一五成本追踪、火一五成本追踪器、Cost Tracker、花费了多少、token 统计。

0· 19·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
Skill name/description match the delivered files: scripts record tokens, compute cost based on pricing.json, store stats and produce reports. However, some code uses a user-specific absolute path (/Users/jobzhao/...) to load config which is inconsistent with other parts that use relative paths or $HOME — this is likely a leftover developer artifact and reduces portability.
Instruction Scope
Runtime instructions and scripts operate locally: they read/write JSON stats under $HOME/.openclaw/workspace/memory/activity, read config/pricing.json and threshold.json, and generate reports. They do not make network calls or request secrets. Scope stays within cost-tracking functionality, but several examples and a code path hardcode /Users/jobzhao which is out-of-scope for a general skill and may cause unexpected behavior.
Install Mechanism
No install spec (instruction-only with included scripts). Nothing is downloaded from external URLs and no packages are installed by the skill itself.
Credentials
The skill requests no environment variables or credentials. It only reads/writes files under the user's HOME workspace directory. This is proportional to its purpose. Note: the hardcoded path bypasses $HOME in one code path, which could unintentionally read another user's files if that path exists.
Persistence & Privilege
always:false and no modifications to other skills or global agent config. The scripts persist only their own JSON stats and backups under the user's workspace — expected for this task.
What to consider before installing
This skill is largely coherent with its stated purpose — it records token counts and computes costs locally and does not request secrets or network access. Before installing or running: 1) Inspect and fix the hardcoded absolute path (/Users/jobzhao/...) in get_model_pricing (and any examples) so the script uses SCRIPT_DIR or $HOME instead; otherwise it may fail or read/write the wrong location. 2) Note sed -i '' usage (macOS-specific) — on Linux this may fail; adapt to portable sed usage. 3) Verify the storage location (~/.openclaw/workspace/memory/activity) and permissions, and back up any existing cost-stats.json before running reset. 4) If you plan to enable automated cron/HEARTBEAT entries, update example paths to your user account and confirm no unintended commands are scheduled. If you are not comfortable editing scripts, treat this as suspicious until the hardcoded paths and portability issues are fixed.

Like a lobster shell, security has layers — review code before you run it.

latestvk973ccvpf8ntebsy91c0ysphah846kax

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

💰 火一五成本追踪器 (huo15-cost-tracker)

作者: 火一五信息科技有限公司
版本: v1.1.0


一、简介

成本追踪器用于记录 AI API 调用统计,包括:

  • Token 消耗(输入/输出)
  • API 调用次数
  • 成本计算
  • 会话时长

核心功能

功能说明
📊 Token 统计记录输入/输出 Token 数量
💵 成本计算基于模型定价计算 USD 成本
📈 调用统计记录 API 调用次数
⏱️ 时长追踪记录会话/任务时长
📋 报表生成生成可视化成本报表

二、工作原理

API 调用 → 记录 Token → 计算成本 → 存储统计 → 生成报表

每次 API 调用时记录:

  • 输入 Token 数量
  • 输出 Token 数量
  • 调用时间
  • 模型名称
  • 响应时长

三、使用方式

3.1 查看当前成本

cd ~/.openclaw/workspace/skills/huo15-cost-tracker
./scripts/report.sh

3.2 重置统计

./scripts/reset.sh

3.3 记录 API 调用

./scripts/track.sh record \
  --input-tokens 1000 \
  --output-tokens 500 \
  --model "MiniMax-M2.1" \
  --duration 1500

3.4 添加到 HEARTBEAT

在 HEARTBEAT.md 中添加定时报告:

## 💰 成本检查(每30分钟)
./scripts/report.sh

四、配置说明

4.1 模型定价

配置文件:config/pricing.json

{
  "MiniMax-M2.1": {
    "inputTokens": 0.01,
    "outputTokens": 0.01,
    "unit": "per 1M tokens"
  },
  "gpt-4o": {
    "inputTokens": 2.5,
    "outputTokens": 10,
    "unit": "per 1M tokens"
  }
}

4.2 报告格式

========================================
💰 成本追踪报表
========================================
会话: 2026-04-05 02:00
----------------------------------------
总 API 调用: 42 次
总 Input Tokens: 125,000
总 Output Tokens: 89,500
----------------------------------------
预估成本: $0.42 USD
----------------------------------------
模型使用分布:
  MiniMax-M2.1: 35 次 (83%)
  其他: 7 次 (17%)
----------------------------------------
最耗时调用: 3,200ms
平均响应时间: 850ms
----------------------------------------

五、成本阈值警告

当成本超过阈值时自动提醒:

# 设置警告阈值(默认 $1.00)
./scripts/track.sh set-threshold 1.0

# 查看当前阈值
./scripts/track.sh get-threshold

阈值配置在 config/threshold.json

{
  "thresholdUSD": 1.0,
  "alertEnabled": true,
  "alertChannel": "wecom"
}

六、定时报告

6.1 添加到 Cron

# 每小时报告
0 * * * * /Users/jobzhao/.openclaw/workspace/skills/huo15-cost-tracker/scripts/report.sh

# 每天报告(早上9点)
0 9 * * * /Users/jobzhao/.openclaw/workspace/skills/huo15-cost-tracker/scripts/daily-report.sh

6.2 每日报告功能

# 生成每日成本摘要
./scripts/daily-report.sh

输出:

📅 每日成本报告 - 2026-04-05
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
今日 API 调用: 42 次
今日 Token: 215,000
今日成本: $0.42 USD
━━━━━━━━━━━━━━━
较昨日: +15% 📈

七、脚本清单

脚本功能
track.sh记录 API 调用
report.sh生成成本报表
reset.sh重置统计数据
config.sh配置管理

六、集成方式

6.1 集成到 API 调用层

在调用 LLM API 时自动记录:

# 调用 API 前
START_TIME=$(date +%s%3N)

# 调用 API...

# 调用 API 后
END_TIME=$(date +%s%3N)
DURATION=$((END_TIME - START_TIME))

# 记录
./scripts/track.sh record \
  --input-tokens $INPUT \
  --output-tokens $OUTPUT \
  --model "MiniMax-M2.1" \
  --duration $DURATION

6.2 集成到 Dream Agent

在 dream.sh 中添加成本追踪:

# Dream Agent 执行后
./scripts/track.sh record \
  --input-tokens $(cat /tmp/dream_input_tokens) \
  --output-tokens $(cat /tmp/dream_output_tokens) \
  --model "MiniMax-M2.1" \
  --duration $(cat /tmp/dream_duration)

七、版本历史

版本日期更新内容
v1.1.02026-04-05新增中文别名:火一五成本追踪,新增阈值警告,新增每日报告
v1.0.12026-04-05修复 shell 变量解析警告
v1.0.02026-04-05初始版本

Files

7 total
Select a file
Select a file to preview.

Comments

Loading comments…