token-dashboard

Warn

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill uses a complex bash script to locate an executable named measure.py by scanning several directories on the user's filesystem, including ~/.claude/skills, ~/.claude/plugins/cache, ~/.claude/token-optimizer, ~/.codex/skills, and ~/.config/opencode/plugins/cache.
  • [DYNAMIC_EXECUTION]: The skill then executes the resolved file path using python3 "$MEASURE_PY". This dynamic resolution and execution of scripts from computed paths is a security risk because it allows for potential hijacking of the execution flow if a malicious file is placed in any of the high-priority search locations.
  • [COMMAND_EXECUTION]: The skill relies on shell commands like find -L, sed, and sort to programmatically determine the execution environment (RUNTIME) and identify the 'best' version of the measurement script to run based on version metadata found in local plugin.json files.
  • [COMMAND_EXECUTION]: The skill performs active data collection and system interaction by running python3 "$MEASURE_PY" collect and python3 "$MEASURE_PY" dashboard to process session data and generate web content.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 11, 2026, 09:38 PM