token-saver
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs legitimate token optimization audits. No suspicious behaviors, network operations to untrusted domains, or sensitive data harvesting were found.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a bundled Node.js script (
scripts/audit.mjs) to perform its audit. This script is self-contained, uses only standard Node.js libraries, and is designed to read configuration files without modifying them or executing their contents. - [INDIRECT_PROMPT_INJECTION]: The audit script processes external files such as
CLAUDE.mdandAGENTS.mdto calculate token usage and check for structural efficiency. While these are external inputs, the script only performs statistical and structural analysis (e.g., line counts, character ratios) and does not interpolate the content into prompts in a way that would allow for safety filter bypasses. (Severity: SAFE)
Audit Metadata