auditing-agent-token-usage
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs a local audit of session logs located in specific directories under the user's home folder (~/.claude and ~/.codex). All data processing is done locally using standard tools like jq, awk, and find, and no network operations are performed.- [COMMAND_EXECUTION]: The script audit-token-usage.sh implements robust input validation for the days parameter using a regular expression (^[1-9][0-9]*$) to ensure it is a positive integer before use, preventing command injection vulnerabilities.- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data in the form of session transcripts. However, it extracts only specific metadata fields (e.g., turn counts, model identifiers, and character lengths) using jq, rather than processing user-provided content as instructions. This structured extraction approach effectively mitigates indirect prompt injection risks.
Audit Metadata