Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

OpenClaw Token Saver

v1.0.1

OpenClaw Token 节省指南。提供5大类20+种减少Token消耗的方法,包括上下文瘦身、工具优化、缓存复用、模型控制和本地替代方案。当Token使用超过阈值时自动触发优化建议。

0· 231·0 current·0 all-time
byjjx@jx-76

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jx-76/jx76-openclaw-token-saver.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "OpenClaw Token Saver" (jx-76/jx76-openclaw-token-saver) from ClawHub.
Skill page: https://clawhub.ai/jx-76/jx76-openclaw-token-saver
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install jx76-openclaw-token-saver

ClawHub CLI

Package manager switcher

npx clawhub@latest install jx76-openclaw-token-saver
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (token savings) match the provided logic and the included token-monitor.py script. However, the guidance includes recommendations to install additional packages, enable exec/read/write tools, and run local model/proxy setups — capabilities that go beyond read-only guidance and require elevated privileges or new software. Those extra recommendations are plausible for a token‑saving tool but are broader than a pure documentation-only skill.
!
Instruction Scope
SKILL.md explicitly instructs operators to install third‑party components (claw-compact, qmd, exa-search, Ollama), to enable tools like exec/read/write/web_search, and to run a Node.js proxy for forwarding web AI calls. These instructions direct running external installers and enabling execution capabilities and also suggest workarounds to avoid official token accounting — actions that access system resources and could be misused or have side effects beyond token optimization.
!
Install Mechanism
The registry has no formal install spec, but the README and SKILL.md recommend running installers and one‑line installers (e.g., curl -fsSL https://ollama.com/install.sh | sh) and clawhub install commands. Recommending curl|sh and installing packages from unspecified taps is higher risk than pure instruction-only content because it leads operators to execute remote code without a pinned, trusted release.
Credentials
The skill declares no required environment variables or credentials (good), and the included Python script does not access secrets or external endpoints. Still, the guidance to enable 'exec'/'read'/'write' tools and to run local proxies is disproportionate to a simple passive guide: enabling these tools grants system access which is not strictly necessary to produce textual optimization tips.
Persistence & Privilege
always is false and there are no declared config paths or credentials the skill will persistently claim. The skill includes a monitoring script and a config example, but it does not request forced installation or elevated platform privileges in the registry metadata.
What to consider before installing
This skill appears to be a genuine token‑saving guide, but before installing or following its commands consider the following: - Do NOT blindly run curl | sh or other remote installers; review the installer contents and prefer vendor documentation or pinned releases. - Avoid enabling powerful tools (exec, write, read) for an untrusted skill — these let code read/write files and execute commands on your machine. - The SKILL.md suggests a local proxy to avoid 'official' token accounting; that may violate provider terms or lead to unexpected billing/behavior — only use such approaches if you understand the legal/billing implications. - If you want to try the included monitoring, inspect scripts/token-monitor.py locally (it is simple and benign) and run it in a sandbox before enabling any automatic actions. - Prefer installing third‑party components from trusted sources (official GitHub releases, distro packages) and review their permissions. If you want to proceed: run the monitor manually first, do not enable exec/write for the skill, and avoid running unreviewed install scripts.

Like a lobster shell, security has layers — review code before you run it.

chinesevk9792582c0bt9p7zjrrczyb8b1832m80cost-savingvk9792582c0bt9p7zjrrczyb8b1832m80latestvk9792582c0bt9p7zjrrczyb8b1832m80openclawvk9792582c0bt9p7zjrrczyb8b1832m80performancevk9792582c0bt9p7zjrrczyb8b1832m80token-optimizationvk9792582c0bt9p7zjrrczyb8b1832m80
231downloads
0stars
2versions
Updated 3h ago
v1.0.1
MIT-0

OpenClaw Token 节省指南

降低 OpenClaw 使用成本的完整策略手册。

自动触发条件

当以下情况发生时,自动调用此 skill:

  1. Token 使用超过 80% - 触发优化建议
  2. 单次请求超过 4000 tokens - 建议压缩上下文
  3. 上下文接近上限 - 自动提示清理方案
  4. 连续 10 轮对话 - 建议压缩或重置

自动响应逻辑

IF token_usage > 80%:
    → 显示警告 + 提供压缩选项
    → 建议使用 /compact
    → 推荐切换到 /nc 模式

IF token_per_turn > 4000:
    → 提示精简输入
    → 建议分批处理
    → 启用工具返回限制

IF context_window > 90%:
    → 强制建议清理
    → 提供 /reset 选项
    → 显示当前 Token 统计

一、上下文瘦身

1. 手动压缩

  • 对话中发送 /compact
  • 自动将长历史转为摘要

2. 滑动窗口

{
  "max_history_messages": 10
}

只保留最近 N 条消息

3. 分层上下文切换

命令作用
/nc仅当前+系统提示
/cc最近10条
/fc全量上下文

4. 重置/新建

  • /reset - 清空当前会话,保留记忆
  • /new - 开启全新对话

5. 自动压缩

安装 claw-compact

clawhub install claw-compact

满15轮或5000 token自动压缩


二、工具与提示词优化

6. 禁用无用工具

只开启必要工具:

{
  "tools": {
    "enabled": ["read", "write", "exec"]
  }
}

系统提示词可从 3500 → 800 token

7. 精简 Skill 描述

  • 技能 YAML frontmatter 保持简洁
  • 描述控制在 100 字以内

8. 限制工具返回

强制工具返回摘要:

{
  "web_search": {
    "max_results": 3,
    "max_chars": 500
  }
}

9. 精简系统提示

{
  "bootstrapMaxChars": 2000
}

三、缓存与复用

10. 开启模型缓存

利用 Anthropic 提示缓存:

{
  "model": "claude-3-sonnet",
  "enable_prompt_caching": true
}

11. 心跳保活

缓存 TTL 1h 时,设置 55min 心跳:

{
  "heartbeat": {
    "interval_minutes": 55
  }
}

12. 本地检索替代

安装 qmd 本地索引:

clawhub install qmd

只取需要的段落,节省 80%+

13. 搜索优化

使用 exa-search

clawhub install exa-search

过滤广告/HTML,返回纯文本,省 70%+


四、模型与调用控制

14. 模型分层

任务类型推荐模型
简单计算/查天气GPT-3.5 / Haiku
代码生成GPT-4 / Sonnet
复杂推理GPT-4o / Opus

15. 关闭重试/兜底

{
  "max_retries": 0,
  "enable_fallback": false
}

16. 限制迭代次数

{
  "max_iterations": 10
}

17. Token 预算

{
  "token_budget": {
    "per_turn": 4000,
    "per_session": 50000
  }
}

五、本地替代

18. 本地部署模型

使用 Ollama:

ollama run qwen2.5:14b

配置 OpenClaw 连接本地:

{
  "model": {
    "provider": "ollama",
    "base_url": "http://localhost:11434"
  }
}

Token 费用为 0

19. 本地代理转发

Node.js 协议转换:

// 走网页版 AI,不耗官方 Token

20. 批量处理

将多个小任务合并为一次请求:

❌ 10次单独请求
✅ 1次批量处理

快速检查清单

  • 配置 max_history_messages: 10
  • 禁用不需要的 tools
  • 安装 claw-compact
  • 设置 Token 预算
  • 使用 /compact 定期压缩
  • 考虑本地模型替代

参考配置

{
  "context": {
    "max_history_messages": 10,
    "auto_compact": true
  },
  "tools": {
    "enabled": ["read", "write", "exec", "web_search"]
  },
  "model": {
    "default": "gpt-3.5-turbo",
    "complex_tasks": "gpt-4"
  },
  "limits": {
    "max_retries": 0,
    "max_iterations": 10,
    "token_budget_per_session": 50000
  }
}

预计节省: 50-90% Token 消耗

Comments

Loading comments...