token-audit

SUSPICIOUS. The skill’s read-only audit behavior mostly matches its stated purpose and shows no exfiltration, but it relies on a transitive install path from a personal GitHub repo and instructs inspection of raw Anthropic credential/proxy env vars and settings, which is broader than necessary and could expose secrets to the model context.