Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description align with the code: a token estimator for multiple models. Declared runtime dependency on python3 and python packages (tiktoken, transformers, dashscope) is consistent with the implementation. Nothing in required binaries/env vars is unexpected or disproportionate.
Instruction Scope
SKILL.md promises a 'Token 水表' (usage meter) and real-time usage display, but the shipped code has no implementation that fetches or aggregates usage from any external API or local store (the --usage flag is defined but not handled). SKILL.md and tests claim integration/accuracy and dashboard features that are not actually implemented, granting the skill more implied capabilities than present. Also the README instructs pip install which will cause the runtime to attempt remote downloads at usage time (see install_mechanism).
Install Mechanism
There is no explicit install spec (instruction-only), but the metadata and SKILL.md instruct users to pip install tiktoken/transformers/dashscope. The code calls AutoTokenizer.from_pretrained('Qwen/Qwen-7B'), which will attempt to download tokenizer/model artifacts from remote hosting (e.g., Hugging Face) if not cached — this can incur large downloads and network access at runtime. No downloads or obscure URLs are embedded in code, but implicit network activity is likely.
Credentials
The skill requests no environment variables or credentials and does not access system config paths. The lack of requested secrets is proportionate to the stated purpose. Note: future SKILL.md items mention integrating '百炼 API usage 字段' (dashscope usage API) but that is not implemented in this release.
Persistence & Privilege
The skill does not request persistent/always-on privileges; flags show always:false and normal autonomous invocation. The skill does not modify other skill configs or claim system-wide changes.
What to consider before installing
What to consider before installing:
- Functionality: The core estimator code is present and appears benign: it uses tiktoken/transformers when available and falls back to a simple character-based estimator. It does not read secrets or exfiltrate data.
- Network and disk: transformers.AutoTokenizer.from_pretrained('Qwen/Qwen-7B') will likely attempt to download tokenizer/model files at runtime if not already cached; expect network access and potentially large downloads. If you need to avoid network calls, preinstall and cache required tokenizers or run in an isolated environment.
- 'Usage meter' mismatch: The SKILL.md promises a usage/dashboard feature, but the current code has no implemented mechanism to fetch or store usage data. Don't assume the meter will work until the skill is updated or integrates with an API and you provide credentials.
- Compression claims: The '4D 压缩' savings are implemented as a fixed 70% heuristic in code — this is a convenience estimate, not measured on your data. Treat cost-savings numbers as optimistic estimates.
- Dependencies: Installing the declared Python packages is required for best accuracy; if transformers or tiktoken are absent, the estimator falls back to a less accurate method.
- Recommendations: Inspect the transformers/dashscope packages you install (especially dashscope, which may be a third-party package). Run the skill in a sandbox or VM first to observe any network/download behavior. If you rely on offline or audited environments, pre-download and pin tokenizer artifacts and/or remove the AutoTokenizer.from_pretrained calls.
If you want, I can (1) point out exactly where to change the code to avoid runtime downloads, (2) show a short checklist to safely run this in a sandbox, or (3) produce a minimal wrapper that uses only tiktoken (no transformers) for safer/easier deployment.Like a lobster shell, security has layers — review code before you run it.
latestvk974ejbj1hrwdbmh5bemxh9gn181xk62
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📊 Clawdis
Binspython3
