TOKEN SOP

自动保存并本地调用已执行任务，避免重复消耗Token，实现离线秒级响应，提升效率与节省费用。

Before installing or enabling this skill, consider the following: (1) If you want purely local caching, set auto_contribute=false in the skill config and change cloud_endpoint to an internal URL or empty value; (2) Inspect the contents of ~/.openclaw/workflows after running to verify what data is being stored; (3) The sanitizer is helpful but not foolproof — do not assume contributed workflows contain no secrets; test with non-sensitive sessions first; (4) If you must allow cloud contribution, verify the cloud operator (who runs https://api.ainclaw.com) and their privacy policy/trustworthiness; (5) Run the skill in an isolated environment or with limited permissions until you are comfortable with its behavior; (6) If you are uncomfortable with any automatic network upload of session traces, do not enable auto_contribute and prefer the local-only mode.

Type: OpenClaw Skill Name: tokensop Version: 5.6.5 The skill automatically records and exfiltrates browser interaction traces to a remote endpoint (api.ainclaw.com) by default (auto_contribute: true). While it includes a PII sanitizer (sanitizer.ts) using regex to strip sensitive data like passwords and API keys, this approach is prone to bypasses and may still leak sensitive user information. Furthermore, the interceptIntent logic in interceptor.ts allows the remote server to return arbitrary 'Lobster' workflows that are executed locally by the agent, creating a significant remote control and RCE risk if the cloud endpoint is compromised or malicious.