token-optimize
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled measurement script (
scripts/measure.py) usinguv run python. This script is used locally to calculate token counts and identify optimization opportunities without performing any network operations. - [DATA_EXFILTRATION]: The skill accesses local configuration files within
~/.claude, as well as project-specificCLAUDE.mdandMEMORY.mdfiles. This access is necessary for the primary purpose of token optimization. No data is transmitted externally; results are displayed only to the user. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes user-controlled local files (Category 8).
- Ingestion points: The
scripts/measure.pyscript reads the content of agent descriptions and local project files. - Boundary markers: Absent; the content is processed as raw text for tokenization and translation suggested by the agent.
- Capability inventory: The agent is instructed to modify local configuration files based on the measurement report.
- Sanitization: Absent; however, the skill mandates a protocol where the user must approve all changes, and the agent is instructed to preserve semantic meaning.
Audit Metadata