Guided token optimization for AI agent workspaces. Triggers on phrases like "save tokens", "optimize tokens", "context window too large", "memory files too b...
Security Analysis
high confidenceThis appears to be a real token-cleanup skill, but it can persistently change future agent behavior and optionally install/download tokenizer components, so it needs user review before installation.
The scanner and cleanup advice fit the stated token-optimization purpose, but the onboarding flow goes beyond auditing by mandating persistent workspace agent-config changes, including a default terse-response mode.
The skill has broad natural-language triggers and supports batch cleanup; it usually asks before moving content, but persistent config insertion/replacement is not scoped with clear per-setting consent.
The package itself has no hidden postinstall behavior in the inspected artifacts; however, its optional installer runs pip against PyPI and two mirrors and prewarms a tokenizer cache from an external OpenAI-hosted blob.
Workspace reads are mostly limited to expected context files such as MEMORY.md, AGENTS.md, memory/, memoryres/, and skills/. The scanner also writes local history outside dry-run and may create/fetch tokenizer cache data when tiktoken is available.
The skill instructs the agent to write long-lived policy blocks into the workspace agent config, replace existing token-slim blocks, record future decisions into memory files, and uses inconsistent backup guidance.
Guidance
Install only if you are comfortable letting the skill read workspace context files and modify agent configuration. Run scans in dry-run mode first, review the exact config blocks before accepting them, avoid batch mode unless you trust every proposed change, and skip the tiktoken installer in restricted environments unless you accept pip installation and external cache downloads.
Latest Release
v1.0.0
Initial open-source release. Workspace token optimization scanner with tiktoken precise counting (auto-fallback to heuristic). Multi-source pip install: PyPI -> Tsinghua -> Aliyun. CWD-anchored cache. Brutal mode toggle. Works on OpenClaw, Claude Code, and any agent runtime.
More by @songhonglei
Published by @songhonglei on ClawHub
