Balance Checker

查询 AI API 服务商的余额（DeepSeek、Moonshot/Kimi、火山引擎）。当用户说"查余额"、"还有多少额度"、"余额多少"时自动触发。

Security Scan

The skill's code and instructions are consistent with its stated purpose (querying balances for DeepSeek, Moonshot/Kimi and Volcengine); it asks for the expected keys, installs a Python SDK into a local venv, and reads the local OpenClaw config to find Volcengine credentials — no evidence of covert exfiltration or unrelated privileges was found, though there are minor inconsistencies and some small issues to watch for.

Purpose & Capability

The name/description match the files and runtime behavior: check_balance.sh queries DeepSeek and Moonshot via their REST endpoints and query_balance.py queries Volcengine via the Python SDK. One inconsistency: registry metadata lists no required environment variables, but SKILL.md and the scripts clearly expect DEEPSEEK_API_KEY, MOONSHOT_API_KEY, VOLCENGINE_ACCESS_KEY and VOLCENGINE_SECRET_KEY.

Instruction Scope

SKILL.md instructs running setup_volcengine.sh and adding keys to ~/.openclaw/openclaw.json or environment variables. The scripts implement only the stated actions: call provider APIs and read credentials from env or from OpenClaw config (~/.openclaw/openclaw.json or clawdbot.json). Reading the OpenClaw config is expected for convenience, but it means the skill will access a local config file — reviewers should be aware it inspects that file to extract VOLCENGINE_* keys.

Install Mechanism

No registry install spec; the included setup_volcengine.sh creates a venv and pip-installs volcengine-python-sdk from PyPI — a standard, low-risk pattern. Minor oddities: setup_volcengine.sh attempts chmod on files (volcengine_balance.sh, setup.sh) that are not present in the package, which appears to be an authoring bug rather than malicious behavior.

Credentials

The skill requests only provider-specific credentials (DeepSeek, Moonshot, Volcengine), which are appropriate for querying balances. However, the package metadata did not declare required env vars while the SKILL.md and scripts do; also query_balance.py will read ~/.openclaw/openclaw.json if env vars are absent (it only looks for VOLCENGINE_ACCESS_KEY/SECRET). Storing secrets in the shared OpenClaw config is a usability trade-off — users should ensure that file's permissions are secure.

Persistence & Privilege

The skill is not always-enabled and does not request elevated system privileges. It installs a local venv under the skill directory and does not modify other skills or global agent settings. The skill can be invoked autonomously by the agent (platform default), which is consistent with its function.

Assessment

This skill appears to do what it says: it queries provider APIs and (for Volcengine) uses a local Python SDK. Before installing: - Confirm you are comfortable storing VOLCENGINE_ACCESS_KEY and VOLCENGINE_SECRET_KEY either as environment variables or in ~/.openclaw/openclaw.json (ensure that file is readable only by you). - Review the scripts (check_balance.sh, query_balance.py, setup_volcengine.sh) yourself; they call only the documented provider endpoints and pip-install the Volcengine SDK into a local venv. - Run setup_volcengine.sh manually in a controlled shell to see what it installs; it installs packages from PyPI (volcengine-python-sdk) into a venv — do this if you trust that package. - Note small authoring bugs (setup script chmods non-existent files, registry metadata omits required env vars) — these are likely mistakes, not malicious behavior, but verify the repository source if you require higher assurance. If you are uncertain about any of the upstream packages (e.g., volcengine-python-sdk), test the skill in an isolated environment or container before adding real credentials.

Balance Checker Skill

一次查询所有 AI API 服务商的余额。

支持的服务商

服务商	查询方式	环境变量
DeepSeek	REST API	DEEPSEEK_API_KEY
Moonshot/Kimi	REST API	MOONSHOT_API_KEY
火山引擎	Python SDK	VOLCENGINE_ACCESS_KEY + VOLCENGINE_SECRET_KEY

触发关键词

• "查余额"
• "还有多少额度"
• "余额多少"
• "看看余额"
• "API 余额"

安装

火山引擎查询需要 Python SDK，首次使用请运行：

cd ~/.openclaw/skills/balance-checker
./setup_volcengine.sh

配置

环境变量（推荐）

export DEEPSEEK_API_KEY=sk-xxx
export MOONSHOT_API_KEY=sk-xxx
export VOLCENGINE_ACCESS_KEY=AKLTxxx
export VOLCENGINE_SECRET_KEY=xxx

OpenClaw 配置

在 ~/.openclaw/openclaw.json 的 env 部分添加上述环境变量。

输出示例

🔍 正在查询 API 余额...

💰 DeepSeek 余额
- 总余额: 304.54 CNY
- 赠金余额: 0.00 CNY
- 充值余额: 304.54 CNY
- 状态: 可用 ✅

🌙 Moonshot/Kimi 余额
- 可用余额: 450.79 CNY
- 现金余额: 450.79 CNY
- 代金券余额: 0 CNY

🌋 火山引擎余额
- 可用余额: 86.68 CNY
- 现金余额: 86.68 CNY

✅ 余额查询完成

文件结构

balance-checker/
├── SKILL.md              # Skill 描述
├── check_balance.sh      # 主入口脚本
├── query_balance.py      # 火山引擎查询（Python）
├── setup_volcengine.sh   # 火山引擎 SDK 安装脚本
└── venv/                 # Python 虚拟环境（自动创建）

API 文档

• DeepSeek: https://api-docs.deepseek.com/zh-cn/api/get-user-balance
• Moonshot: https://platform.moonshot.cn/docs/api-reference#user-balance
• 火山引擎: https://www.volcengine.com/docs/6269/1593138