report-limit
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local JavaScript file using Node.js at
${CLAUDE_PLUGIN_ROOT}/scripts/report-limit.jsto process usage data. - [DATA_EXFILTRATION]: The skill is designed to extract rate-limited 5-hour window data from cached timelines and report it to the
ww-w-ai/claude-code-token-saverrepository on GitHub via GitHub Discussions and Gists. This is the primary function of the skill and requires user confirmation. - [EXTERNAL_DOWNLOADS]: When encountering an unknown model, the skill fetches pricing data from the official Anthropic pricing page at
https://platform.claude.com/docs/en/about-claude/pricing#model-pricingto update local configuration files. - [INDIRECT_PROMPT_INJECTION]: The skill processes external content from the Anthropic pricing page. However, it uses a strict schema-based extraction for specific pricing fields (input, output, cacheCreate5m, cacheCreate1h, cacheRead, contextWindow) before updating the local
model-pricing.jsonfile, which mitigates risks associated with processing untrusted data.
Audit Metadata