cost-tracking
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
sqlite3command-line utility to query a local database file at~/.claude-cost-tracker/usage.db. This is used to calculate and display spending summaries, cost by project, and usage trends. - [DATA_EXPOSURE]: The skill reads from a local usage database which contains model interaction history, token counts, and session identifiers. This access is localized to the user's home directory and is required for the skill's stated purpose.
- [PROMPT_INJECTION]: The skill was evaluated for indirect prompt injection via data ingestion from
~/.claude-cost-tracker/usage.db. Ingestion points: SQL query results from usage.db. Boundary markers: Absent. Capability inventory:sqlite3execution. Sanitization: Absent. The risk is considered negligible as the data consists primarily of numeric token counts and timestamps.
Audit Metadata