token-optimize

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a bundled measurement script (scripts/measure.py) using uv run python. This script is used locally to calculate token counts and identify optimization opportunities without performing any network operations.
  • [DATA_EXFILTRATION]: The skill accesses local configuration files within ~/.claude, as well as project-specific CLAUDE.md and MEMORY.md files. This access is necessary for the primary purpose of token optimization. No data is transmitted externally; results are displayed only to the user.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes user-controlled local files (Category 8).
  • Ingestion points: The scripts/measure.py script reads the content of agent descriptions and local project files.
  • Boundary markers: Absent; the content is processed as raw text for tokenization and translation suggested by the agent.
  • Capability inventory: The agent is instructed to modify local configuration files based on the measurement report.
  • Sanitization: Absent; however, the skill mandates a protocol where the user must approve all changes, and the agent is instructed to preserve semantic meaning.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 12:04 PM
Security Audit — agent-trust-hub — token-optimize