token-burn
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs a legitimate local analysis of Claude Code session logs stored in
~/.claude/projects. The logic is implemented in a Python script (burn_report.py) using only standard libraries. - [COMMAND_EXECUTION]: The agent is instructed to execute a local Python script included with the skill. The script's behavior is transparent and limited to reading JSONL log files, performing calculations, and generating a text/markdown report.
- [DATA_EXFILTRATION]: No network operations were detected. The script does not use any networking libraries (like
requestsorurllib) and only outputs data to the terminal or a specified local file path. - [CREDENTIALS_UNSAFE]: No hardcoded API keys, tokens, or other credentials were found in the instructions or the script.
- [INDIRECT_PROMPT_INJECTION]: While the script reads external log files (which are generated by the agent's own previous sessions), it only extracts specific metadata fields and numeric usage data. It does not execute or evaluate any content from these logs as code.
Audit Metadata