token-dashboard-claude-analytics

SUSPICIOUS. The skill's behavior is largely coherent with its stated purpose: reading local Claude transcript files, caching analytics locally, and serving a localhost dashboard with no stated credential needs or third-party data routing. The main concern is install trust: ara.so publishes the skill, but execution is delegated to a separate personal GitHub repo via git clone + run, outside an official package registry or signed release channel. That mismatch and direct code execution make it a moderate supply-chain risk, but there is no evidence here of credential harvesting, off-host exfiltration, hidden network relays, or disproportionate permissions.