Claude Code Usage

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:22 AM UTC
• Version: 1.2.0

Overview

The quota checker mostly matches its purpose, but an included notification script can send usage-reset messages to a fixed Telegram account, so it needs review before installation.

Install only if you are comfortable with a shell script reading your Claude Code OAuth credential to query Anthropic usage data and with optional scheduled reminders. Before enabling monitoring, inspect or avoid scripts/monitor-and-notify.sh unless the Telegram target is removed or replaced with your own destination, and review any Clawdbot cron jobs so you can disable recurring checks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises and enables shell-based execution paths but does not declare corresponding permissions, which weakens user consent and security review. Even though the shell use may be expected for a utility skill, undeclared execution capability makes the skill more dangerous because it can run local commands, access files, and invoke external tools without explicit permission metadata.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose understates several high-risk behaviors: credential retrieval from secure stores, token refresh side effects, cron job management, and outbound notifications, including a hardcoded Telegram recipient mentioned by the static finding. This mismatch is dangerous because users may invoke the skill expecting a read-only quota check while it can persist scheduled tasks, access secrets, and transmit information externally.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script is described as a usage checker, but when it detects an expired token it performs a side-effecting refresh workflow by invoking the Claude CLI and re-reading credentials. That exceeds a read-only inspection role and can trigger unintended authentication activity, network calls, or state changes without explicit user consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script forces token refresh by piping input into an external claude subprocess, which introduces hidden execution and network side effects unrelated to simply checking limits. This can surprise users, depend on PATH resolution, and potentially execute an unexpected binary in a compromised environment.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script does more than locally check usage limits: it creates and removes persistent cron jobs and triggers external delivery behavior through clawdbot. That expands the skill's authority from read-only status checking into ongoing scheduled execution and outbound notification, which is risky because a user invoking a usage-checking skill may not expect persistent automation or external messaging side effects.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The hardcoded Telegram delivery channel introduces outbound communication capability that is not clearly necessary for a skill whose stated purpose is checking Claude Code usage limits. Even without obvious data exfiltration in this snippet, external message delivery can leak timing, usage-related metadata, or future command content to third-party channels and increases the blast radius of misuse or misconfiguration.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly advertises a self-scheduling chain that 'runs forever with zero maintenance' and sends recurring notifications, but it does not warn users that setup creates ongoing background execution or repeated reminders. In an agent skill context, undocumented persistence and autonomous rescheduling can surprise users, consume resources, and normalize unattended behavior that users may not realize they enabled.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script extracts OAuth credentials from local secret storage and sends the access token to a remote API without a clear upfront disclosure to the user. Even though this is functionally necessary for the feature, silent credential use and transmission can violate user expectations and increases the risk of misuse in an automation context.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The script caches API output to a predictable temporary file path without warning the user, which creates local persistence of potentially sensitive account-usage metadata. On multi-user or less secure systems, this may expose behavioral or account information if file permissions or symlink handling are unsafe.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This script forwards usage-derived content from monitor-usage.sh to Telegram without any validation, minimization, or user disclosure. Even if the intended data is only quota/reset status, the message body is inherited from another script's output and could include account identifiers, timestamps, internal usage details, or unexpected sensitive content, resulting in external data exfiltration.

Credential Access

High

• Category: Privilege Escalation

Content

## Requirements

- **macOS**: Uses Keychain to access Claude Code credentials
- **Linux**: Uses `secret-tool` for credential storage
- **Credentials**: Must have Claude Code CLI authenticated

• Confidence: 84% confidence
• Finding: Keychain

Credential Access

High

• Category: Privilege Escalation

Content

## How It Works

1. Retrieves OAuth token from system keychain
2. Queries `api.anthropic.com/api/oauth/usage` with OAuth bearer token
3. Parses `five_hour` and `seven_day` utilization metrics
4. Calculates time remaining until reset

• Confidence: 91% confidence
• Finding: keychain

Credential Access

High

• Category: Privilege Escalation

Content

# Run a simple query to trigger token refresh
      echo "2+2" | claude >/dev/null 2>&1 || true
      
      # Reload credentials from keychain after refresh
      if [[ "$OSTYPE" == "darwin"* ]]; then
        CREDS=$(security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null || echo "")
      else

• Confidence: 84% confidence
• Finding: keychain

Session Persistence

Medium

• Category: Rogue Agent

Content

exit 0
fi

# Read previous state
SESSION_PREV=$(grep '"session"' "$STATE_FILE" | grep -o '[0-9]*')
WEEKLY_PREV=$(grep '"weekly"' "$STATE_FILE" | grep -o '[0-9]*')

• Confidence: 83% confidence
• Finding: Read previous state

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.