token-dashboard-claude-analytics
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires cloning a repository from an untrusted GitHub user (
https://github.com/nateherkai/token-dashboard.git) as the primary installation method. - [REMOTE_CODE_EXECUTION]: Following the download, the user is instructed to execute local Python code from the repository using
python3 cli.py dashboard. This grants the external code execution privileges on the user's machine. - [DATA_EXPOSURE]: The application's core function is to read sensitive JSONL transcript files located in
~/.claude/projects/(macOS/Linux) orC:\Users\<you>\.claude\projects\(Windows). These files contain the full history of interactions between the user and Claude Code, which may include sensitive source code, internal discussions, and environment variables. - [PERSISTENCE]: The skill provides instructions for automating execution through
crontab(e.g.,0 9 * * * /path/to/daily-stats.sh), which is a persistence mechanism that ensures the script runs regularly on the user's system. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it ingests untrusted data (session transcripts).
- Ingestion points: Reads all JSONL files in the
~/.claude/projects/directory. - Boundary markers: None mentioned for processing individual turn data.
- Capability inventory: The skill starts a local web server, writes to a SQLite database (
~/.claude/token-dashboard.db), and prints to the terminal. - Sanitization: There is no documented validation or sanitization of the transcript content before it is parsed and stored in the SQLite database or rendered in the dashboard UI.
Audit Metadata