cost-metering
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on shell commands for data management and reporting.\n
- The
SKILL.mdandreference/cost-tracking-guide.mdfiles include instructions for the agent to usecat,jq,mkdir,echo, anddateto interact with local files.\n - These commands are used to initialize configurations, log transaction details, and calculate spend metrics, which aligns with the skill's stated purpose.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local log files, creating a potential but low-risk attack surface.\n
- Ingestion points: Reads cost data from
~/.claude/daily-cost.jsonand~/.claude/cost-log.jsonl(referenced inSKILL.md).\n - Boundary markers: The skill uses
jqto parse structured JSON data, providing implicit validation of the data format.\n - Capability inventory: Limited to shell command execution for file manipulation and reporting; no network or administrative capabilities are present.\n
- Sanitization: The use of
jqfor filtering and aggregation ensures that the agent processes data according to a predefined schema.
Audit Metadata