caveman-stats
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a documentation and configuration-only module that enables a local token tracking feature. It describes reading session log files (JSONL) to extract token counts and calculating estimated savings.
- [SAFE]: The skill writes a local stats file to maintain a record of 'lifetime savings' for a status line badge. This is a legitimate application of local file persistence for user interface enhancements and does not involve unauthorized system modifications.
- [SAFE]: The use of external JavaScript hooks (
hooks/caveman-stats.js) described in the metadata is a standard platform-specific mechanism for command interception. This implementation ensures that statistics are returned directly to the user as a 'blocked-decision' reason, which effectively prevents the AI model from seeing or misinterpreting the raw log data, serving as a security boundary.
Audit Metadata