Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

usage-costs

v1.0.0

Report AI token usage and estimated costs. Use when: owner asks about costs today/yesterday/this week, per session, or per model. Shows main session, cron jo...

0· 76·0 current·0 all-time
byNetanel Abergel@netanel-abergel

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for netanel-abergel/usage-costs.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "usage-costs" (netanel-abergel/usage-costs) from ClawHub.
Skill page: https://clawhub.ai/netanel-abergel/usage-costs
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install usage-costs

ClawHub CLI

Package manager switcher

npx clawhub@latest install usage-costs
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (report token usage and estimated costs) matches what the SKILL.md does: it reads OpenClaw live status, cron run JSONL files, and token-history JSONL to compute usage and costs. No unrelated external services, credentials, or installs are requested.
!
Instruction Scope
Instructions tell the agent to 'source' a local .context file at /opt/ocana/... which will execute any shell code in that file (execution risk). The skill reads many local files (/opt/ocana/... cron runs, sessions, token-history) and explicitly instructs appending JSON to token-history.jsonl — i.e., it both reads and writes system-wide data. Reading those OpenClaw files is coherent for cost reporting, but sourcing an arbitrary file and writing to shared data increase the attack surface and privilege requirements.
Install Mechanism
Instruction-only skill with no install spec, no external downloads, and no dependencies. This is the lowest install risk.
!
Credentials
Registry metadata declares no required env vars, but SKILL.md expects variables provided by the sourced .context (OWNER_PHONE, PRICING_INPUT/OUTPUT/CACHE_READ). That mismatch means the skill will obtain configuration/secret values from an on-disk file rather than declared env vars. Sourcing a file to obtain these values can execute code and may expose hidden local settings; the skill does not request or need external API keys but it does access local potentially sensitive state.
Persistence & Privilege
The skill is not marked always:true and is instruction-only (no persistent install). However it instructs appending daily reports to /opt/ocana/openclaw/workspace/data/token-history.jsonl, so it will modify on-disk state under the OpenClaw workspace. Autonomous invocation is allowed by default (normal), which means the agent could run these read/write actions without extra user intervention.
What to consider before installing
This skill appears to do what it claims (compute token usage/costs from OpenClaw data), but there are concrete operational risks you should consider before installing or enabling it: - Inspect the .context file (/opt/ocana/openclaw/workspace/skills/usage-costs/.context) before allowing the skill to run. Because the skill sources that file, any shell code in it would be executed — ensure it contains only simple key=value lines and no commands. - Confirm the OpenClaw CLI and the directories referenced (/opt/ocana/openclaw/cron/runs, /opt/ocana/openclaw/agents/main/sessions, /opt/ocana/openclaw/workspace/data) are accessible only to trusted users; the skill reads potentially sensitive session and run logs. - Be aware the skill appends to token-history.jsonl. If you want read-only reporting, avoid or sandbox the write step (or require manual approval before writes). - Prefer safer alternatives: instead of sourcing a shell file, the skill could parse a JSON config or accept explicit declared env vars. If you maintain this environment, consider replacing 'source' with a non-executing parser. - Run the skill with least privilege (non-root agent user) and, if possible, test in a staging environment first. Why 'suspicious' rather than 'benign': there is no evidence of misdirection or external exfiltration, but the use of 'source' on a file and implicit reading/writing of shared system files increases risk and constitutes a mismatch with the declared metadata (no env vars declared). If you can confirm the .context contents are benign and you accept the on-disk writes, the remaining footprint is reasonable for the stated purpose. If you want higher confidence, provide the contents of the .context file (or confirm it's purely key=value), and confirm file permissions/owners for the referenced paths — that information would allow raising confidence to high or downgrading the concern.

Like a lobster shell, security has layers — review code before you run it.

latestvk9780g24ktpfbrpa137hz751ah84bwrs
76downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Usage Costs Skill

Reports token usage and estimated costs from OpenClaw sessions.


Load Local Context

CONTEXT_FILE="/opt/ocana/openclaw/workspace/skills/usage-costs/.context"
[ -f "$CONTEXT_FILE" ] && source "$CONTEXT_FILE"
# Provides: $OWNER_PHONE, $PRICING_INPUT, $PRICING_OUTPUT, $PRICING_CACHE_READ

Data Sources

  1. Live sessionsopenclaw status --deep (current token counts per session)
  2. Cron run history/opt/ocana/openclaw/cron/runs/*.jsonl (usage field per run)
  3. Token history/opt/ocana/openclaw/workspace/data/token-history.jsonl (daily aggregates)

Pricing (claude-sonnet-4-6, as of 2026-04)

TypePrice
Input$3.00 / 1M tokens
Output$15.00 / 1M tokens
Cache read$0.30 / 1M tokens
Cache write$3.75 / 1M tokens

Step 1 — Live Session Report

# Get current session token counts
openclaw status --deep 2>/dev/null | grep -E "agent:main|direct|cached" | head -20

Parse output: each row has session_key | kind | age | model | tokens.


Step 2 — Cron History Report

#!/usr/bin/env python3
import json, glob, os
from datetime import datetime, timezone, timedelta

def get_cron_usage(days_back=1):
    cutoff = datetime.now(timezone.utc) - timedelta(days=days_back)
    cutoff_ts = cutoff.timestamp() * 1000

    total_input = 0
    total_output = 0
    runs = []

    for f in glob.glob('/opt/ocana/openclaw/cron/runs/*.jsonl'):
        job_name = os.path.basename(f).replace('.jsonl', '')
        with open(f) as fh:
            for line in fh:
                try:
                    d = json.loads(line)
                    if d.get('ts', 0) >= cutoff_ts and 'usage' in d:
                        inp = d['usage'].get('input_tokens', 0)
                        out = d['usage'].get('output_tokens', 0)
                        total_input += inp
                        total_output += out
                        runs.append({
                            'job': d.get('name', job_name),
                            'input': inp,
                            'output': out,
                            'ts': d['ts']
                        })
                except:
                    pass

    return total_input, total_output, runs

inp, out, runs = get_cron_usage(days_back=1)
cost = (inp / 1_000_000 * 3) + (out / 1_000_000 * 15)
print(f"Cron tokens (last 24h): {inp:,} in / {out:,} out")
print(f"Estimated cost: ${cost:.2f}")
print(f"Runs: {len(runs)}")

Report Formats

"How much did today cost?"

📊 Cost Report — 2026-04-04

Main session: ~276K tokens (100% cached)
Cron runs: 25 runs | X in / Y out tokens
Subagents: N sessions | X tokens

Estimated total: ~$Z
(Cron: $A | Subagents: $B | Main session: estimated $C)

Note: Main session cost is estimated — cache reduces actual cost by ~90%.

"How much this week?"

  • Read from /opt/ocana/openclaw/workspace/data/token-history.jsonl
  • Sum daily entries for the last 7 days
  • Show per-day breakdown + total

"How much was this session?"

  • Run openclaw status --deep
  • Find agent:main:main row → tokens field
  • Calculate: input_cost + output_cost (apply cache discount if cached%)

Save Daily Report

Append to /opt/ocana/openclaw/workspace/data/token-history.jsonl:

{"date": "2026-04-04", "input": 133, "output": 17376, "cache_read": 900000, "cost_usd": 0.54, "cron_runs": 25, "subagent_runs": 4}

Cost Extraction Script (from session jsonl files)

This is the authoritative method for extracting real costs — works for Anthropic/Claude models:

python3 -c "
import json, glob, os
from datetime import datetime, timezone

sessions_dir = '/opt/ocana/openclaw/agents/main/sessions'
files = glob.glob(f'{sessions_dir}/*.jsonl')
today = datetime.now(timezone.utc).date()
total_cost = 0
total_cache_write = 0
total_cache_read = 0
sessions_today = 0

for fpath in files:
    mtime = datetime.fromtimestamp(os.path.getmtime(fpath), tz=timezone.utc).date()
    if mtime != today:
        continue
    sessions_today += 1
    with open(fpath) as f:
        for line in f:
            try:
                l = json.loads(line)
                if l.get('type') == 'message' and l.get('message',{}).get('role') == 'assistant':
                    u = l['message'].get('usage',{})
                    total_cost += u.get('cost',{}).get('total',0)
                    total_cache_write += u.get('cacheWrite',0)
                    total_cache_read += u.get('cacheRead',0)
            except: pass

print(f'Today: {sessions_today} sessions — \${total_cost:.2f}')
print(f'Cache writes: {total_cache_write:,} tokens')
print(f'Cache reads: {total_cache_read:,} tokens')
"

⚠️ Provider compatibility:

  • ✅ Works for: Anthropic Claude (sonnet, haiku, opus)
  • ❌ Does NOT work for: Google Gemini, OpenAI GPT — cost field is empty
  • For Google/OpenAI agents: use provider billing dashboard directly

Trigger Phrases

"how much did today cost?" "how much was this session?" "how much this week?" "show me costs"

  • "usage report"
  • "token usage"

Comments

Loading comments...