The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes node -e to perform file existence checks and to execute logic for parsing JSONL data. These scripts are hardcoded within the skill, use standard Node.js built-in modules (fs, os, path), and do not incorporate unvalidated user input into the shell command.
[DATA_EXPOSURE]: The skill reads the ~/.claude/metrics/costs.jsonl file. While this is located in the user's home directory, the access is restricted to application-specific cost metrics required for the skill's stated purpose. There is no evidence of the skill accessing sensitive system files (e.g., SSH keys, environment variables) or performing network operations to exfiltrate the data.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external log data.
Ingestion points: The skill reads log entries from ~/.claude/metrics/costs.jsonl as documented in SKILL.md.
Boundary markers: Not applicable; the skill parses raw JSON data for internal calculation rather than interpolating it directly into a prompt.
Capability inventory: The skill uses node -e for parsing and calculation logic (SKILL.md).
Sanitization: The processing script uses JSON.parse() within a try-catch block and explicitly casts extracted values to numbers using Number() before performing calculations, effectively sanitizing the input data against code injection.

cost-tracking