usage-view
Warn
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill implements a dynamic instruction generation pattern. The main agent is instructed to launch a background agent that runs a local script, parses its JSON output to locate an 'agentPromptFile', and then reads that file and 'follows the instructions exactly'. This allows the agent's behavior to be dynamically defined by runtime-generated file content rather than static instructions.
- [DATA_EXPOSURE]: The skill accesses highly sensitive data stored in
~/.claude/projects/, which contains full JSONL transcripts of the user's Claude Code conversations. While this access is necessary for the stated purpose of token and cost analysis, it involves processing the user's private interaction history. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (user conversation transcripts) and interpolates parts of that content—such as first and last messages—into an LLM subagent's prompt for 'AI Insights'. This creates a surface for indirect prompt injection where malicious instructions embedded in a conversation transcript could attempt to influence the subagent's analysis or output.
- [EXTERNAL_DOWNLOADS]: The skill includes logic to fetch updated model pricing information from Anthropic's official documentation website when it encounters an unknown model. This targets a well-known service to maintain the accuracy of the cost dashboard.
Audit Metadata