Token Estimator

预估本次请求的 Token 消耗量，支持多模型精确计算

What to consider before installing: - Functionality: The core estimator code is present and appears benign: it uses tiktoken/transformers when available and falls back to a simple character-based estimator. It does not read secrets or exfiltrate data. - Network and disk: transformers.AutoTokenizer.from_pretrained('Qwen/Qwen-7B') will likely attempt to download tokenizer/model files at runtime if not already cached; expect network access and potentially large downloads. If you need to avoid network calls, preinstall and cache required tokenizers or run in an isolated environment. - 'Usage meter' mismatch: The SKILL.md promises a usage/dashboard feature, but the current code has no implemented mechanism to fetch or store usage data. Don't assume the meter will work until the skill is updated or integrates with an API and you provide credentials. - Compression claims: The '4D 压缩' savings are implemented as a fixed 70% heuristic in code — this is a convenience estimate, not measured on your data. Treat cost-savings numbers as optimistic estimates. - Dependencies: Installing the declared Python packages is required for best accuracy; if transformers or tiktoken are absent, the estimator falls back to a less accurate method. - Recommendations: Inspect the transformers/dashscope packages you install (especially dashscope, which may be a third-party package). Run the skill in a sandbox or VM first to observe any network/download behavior. If you rely on offline or audited environments, pre-download and pin tokenizer artifacts and/or remove the AutoTokenizer.from_pretrained calls. If you want, I can (1) point out exactly where to change the code to avoid runtime downloads, (2) show a short checklist to safely run this in a sandbox, or (3) produce a minimal wrapper that uses only tiktoken (no transformers) for safer/easier deployment.

Type: OpenClaw Skill Name: token-estimator Version: 1.0.1 The OpenClaw skill 'token-estimator' is classified as benign. The `SKILL.md` provides clear, descriptive instructions without any evidence of prompt injection attempts against the AI agent. The core script `scripts/token-estimator.py` uses standard libraries (`tiktoken`, `transformers`, `dashscope`) for its stated purpose of estimating token consumption. While `transformers.AutoTokenizer.from_pretrained` involves downloading model data from external sources, this is a standard and expected behavior for the library and is not indicative of malicious intent from the skill itself. The code explicitly avoids file system manipulation, environment variable access, shell execution, and data exfiltration, aligning with the '安全机制' (security mechanism) claims in the documentation.