studio-ledger
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a local ledger system for tracking AI generation costs and assets. It uses standard Node.js modules (node:fs, node:sqlite, node:crypto) to maintain append-only JSONL files and a local SQLite index.- [SAFE]: The backfill functionality reads from specific paths in the user's home directory (~/.hominem/ai_usage, ~/Developer/studio/...). While these are sensitive locations, the access is consistent with the skill's primary purpose of importing legacy usage data.- [SAFE]: Data persistence is handled via local files and a disposable SQLite database. Input from external sources (JSON logs and stdin) is processed using prepared statements in the SQLite indexer, preventing potential SQL injection.- [SAFE]: No network connectivity, remote code execution, or obfuscation techniques were identified in the codebase.
Audit Metadata