TokenSaver

한국어에 최적화된 OpenViking 기반 컨텍스트 DB로 토큰 91% 절감, 계층 구조 메모리 관리 및 자동 압축 기능을 제공합니다.

This package appears to implement a local context DB and compression as advertised, but it includes developer artifacts and scripts that will read and index user workspace files and even reference a ClawHub token path. Before installing or running: - Review the bundled Python files (especially auto_sync.py, init_bora_context.py, auto_recall.py, daily_summary.py, HANDOVER.md) for hard-coded paths and any code that opens files in your home/workspace. - Do not run convenience scripts (init_bora_context.py, auto_recall.py, daily_summary.py) unless you inspect and modify paths to a safe test directory. init_bora_context.py in particular tries to open files at C:\Users\Roken\... which is a leftover dev path and may reveal how the package will behave. - If you want to try it, run it inside an isolated environment or container and set the workspace directory explicitly to an empty directory (the AutoSync and ContextStore constructors accept workspace/base_path arguments). Example: create_auto_sync(workspace_path='~/tmp/safe_tokensaver_workspace'). - Search the package for any references to '.secrets', 'clawhub_token', or other token/secret file paths and remove or sandbox them. - Because the skill will read and write files under your home/workspace, avoid running it with sensitive files present or grant only to a directory you control. Given the presence of hard-coded dev paths and secret-file references, treat this skill as potentially privacy-sensitive until you validate and sanitize the code and workspace paths.

Type: OpenClaw Skill Name: openviking-korean Version: 3.1.0 The skill bundle contains numerous hardcoded absolute paths to a specific user's directory (C:\Users\Roken\...) across multiple files, including init_bora_context.py, auto_recall.py, and tests/test_tokensaver.py. It specifically targets and ingests sensitive workspace files like SOUL.md, IDENTITY.md, and USER.md into its own local storage. While the core logic for token saving via text compression appears functional and lacks clear exfiltration code, the hardcoded environment and the ingestion of private agent data without generalization are significant red flags for a shared skill.