📦 Caveman Input Compression — 穴人压缩省Token
v0.1.0每次加载会话前，把工作区引导文件压缩成“穴人语”，显著减少输入Token；覆盖前自动生成.original.md备份，安全可回滚。
0· 62·0 当前·0 累计
by 下载技能包
最后更新
2026/4/12
安全扫描
OpenClaw
可疑
medium confidenceThe skill's code mostly matches its stated purpose (compress workspace markdown via local/remote LLMs) but contains multiple misleading claims and small inconsistencies that warrant caution before installation.
评估建议
This skill is likely what it claims (a workspace markdown compressor) but has small inconsistencies and a few security-relevant behaviors you should be aware of: (1) the backup filename in code is '.md.original' whereas SKILL.md says '.original.md' — confirm where backups will land before running; (2) the implementation passes your file content and API keys to subprocess commands (claude CLI and curl) as command arguments, which can expose them to other local processes via the process list — pre...详细分析 ▾
✓ 用途与能力
Name/description match the code: it compresses markdown files under ~/.openclaw/workspace, creates a backup, and uses a model fallback chain (claude CLI → OpenAI-compatible endpoints → DeepSeek). The requested credentials (optional API keys) are proportional to this purpose.
⚠ 指令范围
SKILL.md claims 'No user content as shell arguments' and 'Creates .original.md backups', but the implementation: (1) sends user content to subprocess.run for the claude CLI and for curl's -d argument (content appears as command arguments), and (2) creates backups with a different suffix (code uses .md.original, SKILL.md says .original.md). The claude path does not truncate content, so very long files could exceed command-line argument limits. The code does limit content for OpenAI-compatible fallback to 10k chars, but not for claude.
✓ 安装机制
No install spec (instruction-only install) and the package is just Python files included in the skill. Nothing is being downloaded or extracted from third-party URLs during install.
ℹ 凭证需求
No required env vars declared in registry, but the code optionally uses MINIMAX_BASE_URL, MINIMAX_API_KEY, OPENAI_API_KEY, DEEPSEEK_API_KEY, COMPRESSION_MODEL and feature flags like CAVEMAN_COMPRESS_MEMORY. These are reasonable for remote model access. However, API keys are passed as literal command arguments/headers to curl and appear on the subprocess command line (and therefore might be visible to other local processes), which is a sensitive handling detail the SKILL.md does not call out.
✓ 持久化与权限
Skill is not always-enabled, does not request elevated system persistence, and does not modify other skills or system-wide settings. It operates as a one-shot on explicit paths.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/4/12
Initial release of caveman-compress. - Compresses workspace bootstrap files into caveman-speak, reducing input tokens by ~45%. - Creates `.original.md` backup before overwriting files and aborts if backup exists. - Only compresses SOUL.md, IDENTITY.md, and USER.md by default; AGENTS.md, HEARTBEAT.md, and MEMORY.md require feature flags. - Files larger than 500KB are rejected for safety. - Supports multiple model backends (claude CLI, MiniMax, DeepSeek) using subprocess + curl. - Includes dry-run option and environment variable controls for model and file support.
● 可疑
安装命令
点击复制官方npx clawhub@latest install caveman-compress
镜像加速npx clawhub@latest install caveman-compress --registry https://cn.longxiaskill.com