token-dashboard
Warn
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses a complex bash script to locate an executable named
measure.pyby scanning several directories on the user's filesystem, including~/.claude/skills,~/.claude/plugins/cache,~/.claude/token-optimizer,~/.codex/skills, and~/.config/opencode/plugins/cache. - [DYNAMIC_EXECUTION]: The skill then executes the resolved file path using
python3 "$MEASURE_PY". This dynamic resolution and execution of scripts from computed paths is a security risk because it allows for potential hijacking of the execution flow if a malicious file is placed in any of the high-priority search locations. - [COMMAND_EXECUTION]: The skill relies on shell commands like
find -L,sed, andsortto programmatically determine the execution environment (RUNTIME) and identify the 'best' version of the measurement script to run based on version metadata found in localplugin.jsonfiles. - [COMMAND_EXECUTION]: The skill performs active data collection and system interaction by running
python3 "$MEASURE_PY" collectandpython3 "$MEASURE_PY" dashboardto process session data and generate web content.
Audit Metadata