TokenSaver Korean

🧠 한국어 Context DB for AI Agents — 토큰 91% 절감. 임베딩 의미 검색, 중복 자동 병합, 메모리 계층화(Hot/Warm/Cold), 자동 아카이브, WAL 프로토콜, 엔티티 추출. Korean-first + English support.

This skill appears to implement what it claims, but exercise caution before installing or running it: - Inspect and (if needed) remove or edit init_bora_context.py before running. It contains hard-coded Windows paths that read several workspace files and then save them into the memory DB; these files could contain sensitive info and will be sent (for embedding) to the external Fireworks API if a key is present. - Only provide a FIREWORKS_API_KEY you trust. Treat that key as granting the embedding service access to any text you send. - If you want to try the skill safely, run it in an isolated environment or test VM, and do not export your real workspace paths or secrets into that environment. - Confirm you are happy with local storage of embeddings.json/wal.json and where client.save_memory persists data. - The README contains an odd npm-related instruction for installing a Python package—review packaging/install steps carefully before copying files into ~/.openclaw or running automated install commands. If you want higher assurance, ask the author for a version of the initializer that prompts before reading files or accepts explicit file paths, and a minimal README that documents exactly which local paths the skill will read and what data it will send to api.fireworks.ai.

Type: OpenClaw Skill Name: token-saver-korean Version: 2.0.0 The skill bundle contains a script, 'init_bora_context.py', which uses hardcoded absolute Windows file paths targeting a specific user's directory ('C:\Users\Roken\.openclaw\workspace\'). This script attempts to read sensitive agent files such as 'SOUL.md', 'IDENTITY.md', and 'USER.md' to ingest them into the TokenSaver database. While the core logic in 'token_saver/client.py' appears to be a legitimate context management tool using Fireworks AI for embeddings, the inclusion of environment-specific scripts that target sensitive identity files from a hardcoded local path is a high-risk behavior. There is no clear evidence of intentional exfiltration to an attacker-controlled domain, but the targeting of specific local files makes the bundle suspicious.