token-budget-gate

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Bash to manage a local calibration log at .claude/token_calibration/log.tsv. It uses mkdir -p to create the directory and printf to append tab-separated values (task type, estimated cost, actual cost, multiplier, and date) to the log file. This is a standard and safe implementation for local data persistence.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: While the skill reads and writes to a local .claude subdirectory, this is a common practice for agent configuration and state. There are no network operations or attempts to exfiltrate this data to external servers.
  • [DYNAMIC_EXECUTION]: The skill calculates a 'Final formula' for token estimation (base × file_multiplier × agent_multiplier × iteration_multiplier). This calculation is performed by the LLM based on instructions and does not involve the execution of dynamically generated code or unsafe deserialization.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 12:47 AM