token-saver-copilot
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to run a local Node.js script (
scripts/audit.mjs) to perform its primary function. This script is distributed as part of the skill and is executed in the user's environment to analyze configuration files. - [SAFE]: The
audit.mjsscript is dependency-free and utilizes only built-in Node.js modules (fs,path,os,url). It performs read-only operations on local configuration files (e.g.,.github/copilot-instructions.md,~/.claude.json,.cursorrules) to calculate token estimates and verify settings. It does not perform network operations or attempt to modify system files. - [SAFE]: The skill proposes appending a "Token discipline" instruction snippet to the user's repository configuration files (
.github/copilot-instructions.mdorAGENTS.md). This action is transparently described and intended to be performed only after receiving explicit user agreement. - [SAFE]: Although the audit script accesses configuration files in the user's home directory (such as Claude Code or Cursor settings), these actions are strictly aligned with the skill's stated purpose of optimizing AI credit usage across multiple development tools.
Audit Metadata