anth-cost-tuning
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is designed for cost analysis and provides Python snippets for calculations. It includes strong privacy guidance, requiring that API keys, raw billing exports, and customer content be excluded from reports.
- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface by ingesting API usage data and token counts from Claude Code environments (SKILL.md). It mitigates this by instructing the use of redacted measurement windows and synthetic prompts, while utilizing capabilities like Read and Write (allowed-tools) for analysis. Boundary markers are present through explicit instructions to exclude prompt/response content from analysis results.
Audit Metadata