📦 Box-KVCache — 本地KV缓存压缩
v1.1.0在本地对LLM的KV Cache做低秩分解+INT8量化，推理时GPU显存直降2-4倍，无需改动模型结构，开箱即用。
0· 69·0 当前·0 累计
by 下载技能包
最后更新
2026/4/5
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This package appears to implement the described KV-cache compression algorithms and helper scripts, but review before running:
- Inspect scripts locally (they are included) and run them in a sandbox or non-production environment first.
- Note platform bias: many checks use Windows commands; Linux/macOS behavior may be limited. Test on your target OS.
- Be aware scripts invoke shell commands (subprocess with shell=True in run_cmd). While current commands are internal, avoid running with elevated ...详细分析 ▾
ℹ 用途与能力
Name/description match the included code: the scripts implement low-rank SVD compression and INT8 quantization for KV caches and helpers to detect/run Ollama/llama.cpp. However, the SKILL.md claims cross-platform support (Windows, Linux, macOS) while the scripts are largely Windows-biased (use 'tasklist | findstr', 'where', PowerShell fallbacks). The SKILL.md also documents OLLAMA_* environment variables as useful, but none are required in the registry metadata and the scripts do not actually read OLLAMA_HOST / OLLAMA_MODELS / OLLAMA_KEEP_ALIVE — this is an internal inconsistency.
ℹ 指令范围
Runtime instructions and scripts stay within the stated purpose (environment detection, compression, quantization, and launching Ollama). They run local subprocess commands (ollama, nvidia-smi, pip, systeminfo/tasklist/where) and perform on-disk saves/loads of compressed arrays. A few minor issues: several commands use shell=True in run_cmd (which can be risky if later passed untrusted input), and some Windows-only commands are used despite cross-platform claims. There is no evidence the scripts attempt to read unrelated credentials or exfiltrate data to remote endpoints.
✓ 安装机制
No install specification is provided (instruction-only in registry), and all code is included in the bundle. Nothing is downloaded from external URLs during installation. This limits supply-chain risk compared with remote downloads.
ℹ 凭证需求
The skill declares no required environment variables or credentials in registry metadata (good). SKILL.md documents optional OLLAMA_* variables but they are informational only — the scripts do not read those variables. No secrets or unrelated credentials are requested. This mismatch (documented env vars vs actual usage) is inconsistent but not directly dangerous.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills or system-wide configurations. It can start/launch an Ollama local service (calls 'ollama serve' and runs 'ollama run'), which is expected for this functionality but means it will start local processes if you run it.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.02026/4/5
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install box-kvcache
镜像加速npx clawhub@latest install box-kvcache --registry https://cn.longxiaskill.com