token-budget-gate
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
Bashto manage a local calibration log at.claude/token_calibration/log.tsv. It usesmkdir -pto create the directory andprintfto append tab-separated values (task type, estimated cost, actual cost, multiplier, and date) to the log file. This is a standard and safe implementation for local data persistence. - [DATA_EXPOSURE_AND_EXFILTRATION]: While the skill reads and writes to a local
.claudesubdirectory, this is a common practice for agent configuration and state. There are no network operations or attempts to exfiltrate this data to external servers. - [DYNAMIC_EXECUTION]: The skill calculates a 'Final formula' for token estimation (
base × file_multiplier × agent_multiplier × iteration_multiplier). This calculation is performed by the LLM based on instructions and does not involve the execution of dynamically generated code or unsafe deserialization.
Audit Metadata