token-stats-skill

• Outcome: Pass
• Latest audit: Oct 2, 2026 · 5:31 AM UTC
• Version: 0.0.4

Overview

This skill is a disclosed token-usage recorder with optional consent-gated Trae sync and scheduling, but users should be comfortable with a pinned opaque CLI reading sensitive local agent data.

Install only if you trust the token-stats v0.0.4 binary publisher and are comfortable granting it access to local agent usage stores. Keep Trae CN sync and scheduler installation as separate explicit approvals, review the previewed plist paths and data directories, and avoid running one-off recording from a shell containing unrelated sensitive environment variables when possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (37)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

story. Explain each relevant side effect and obtain the user's authorization first. Never auto-install or auto-update a missing/mismatched CLI.
- Before executing the CLI, verify its executable against `scripts/cli-release.json` using `python3 -I scripts/token_recorder.py verify --bin /absolute/path/to/token-stats`. The recording wrapper repeats this check each run. Do not bypass a hash mismatch, disable security tools, or use an unpinned latest-release URL.
- `usage`, `report range`, and the recorder use local data; `--refresh` does **not** sync Trae. Only an explicitly authorized `trae sync` contacts `https://api.trae.cn`. Never add it to the offline recorder or scheduler. Read [Trae CN](references/trae-cn.md) before using its status/sync workflow.
- Do not ask for credentials in chat, print login-file contents, extract tokens with generic file tools, or upload reports/logs. `trae status` is optional and reads existing login metadata; use it only for requested Trae setup. Keep it out

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/token_recorder.py (reported line 451)May include surrounding context.

python

args = parser().parse_args()
    try:
        if args.command == "record":
            record(dict(os.environ))
        elif args.command == "verify":
            binary, digest = trusted_binary(args.bin)
            print(json.dumps({"binary": binary, "sha256": digest, "verified": True}))

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares shell, file read/write, and environment-dependent behavior but does not define an explicit tool scope or permission boundary. In an agent ecosystem, that omission can let a host grant broader capabilities than intended, increasing the chance of unintended file access, command execution, or persistent system changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

This section instructs the agent on installing periodic recording, replacing existing tasks, and optionally starting immediately, which introduces persistence on the user's machine. Even though the text emphasizes consent, persistence mechanisms are security-sensitive because they can outlive the current session and continue collecting data or executing code regularly.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

2. For one-day collection, prefer `scripts/record-token-usage.sh` with explicit `TOKEN_STATS_BIN`, `AI_TOKEN_AGENT`, and optionally `AI_TOKEN_DAY`/`AI_TOKEN_DATA_DIR`. It always refreshes offline. Full per-run snapshots are disabled unless `AI_TOKEN_RUN_DIR` is set.
3. For stored history, use `usage --refresh=false` or `report range`. Today's plain `usage` refreshes automatically; historical days and range reports do not. A missing daily record is a data gap, not zero. Rebuild only requested dates with `--refresh`, including old `all` reports that predate new collectors or Trae synchronization.
4. For requested Trae CN data, follow the separate consent, account-selection, synchronization, and offline-report workflow. Account-wide usage can include other devices; it cannot be split reliably into IDE, SOLO, or Work clients.
5. For requested periodic recording, preview the installer, show interval/source/paths/timezone/retention and persistence to the user, then confirm only the agreed plan. Existing tasks require `--replace`; immediate execution requires `--start-now`. Do not create a scheduler merely to answer a one-off usage question.
6. Analyze `total.totalTokens` directly. Use `byAgent`, `byProvider` (with nested `models`), `byProviderModel`, `byModel`, `byDay`, `byRateLimit`, and `attribution` as breakdowns, not additional totals. `byModel` is provider-independent, so one model reached through several providers is one bucket there and several under `byProvider`. State a source's `attribution` share before presenting its provider split as complete. Daily reports contain `sessions`; ranges contain `days`. Preserve meaningful warnings, skipped-line counts, missing coverage, and the distinction between local and account-wide data.

## Common Commands

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The example command references a launchd installer script and describes plist/service behavior, confirming the skill supports creation of persistent scheduled tasks. Preview-only wording reduces risk, but the presence of persistence tooling is still a genuine security concern because it can be used to establish recurring execution and ongoing data collection.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

token-stats usage --agent codex --day YYYY-MM-DD --refresh=false --output json token-stats report range --agent codex --from YYYY-MM-DD --to YYYY-MM-DD --output json

Read-only scheduler preview: no plist, service, or output-directory changes.

./scripts/install-launchd-token-recorder.sh --agent codex --interval 1800
--bin "$HOME/.local/bin/token-stats" --timezone Asia/Shanghai

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/recorder-security.md (reported line 19)May include surrounding context.

--bin "$PWD/token-stats_v0.0.4_darwin_arm64/token-stats"

text

Only after successful verification, install into the approved location. Review and preserve an existing destination before replacing it. Never elevate with sudo or overwrite an unknown program automatically. Verify the final absolute binary path before `version --output json`.

The wrapper accepts only the pinned executable hash for the current OS/architecture. It resolves PATH/symlinks to an absolute path, requires trusted ownership and no group/other-writable executable or ancestors, and hashes before every run. Mismatch fails closed without execution. A newer CLI needs a reviewed manifest update, not a bypass flag.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

This describes installation of a launchd job that provides periodic execution and login persistence. Even though it is framed as user-authorized and requires confirmation, it is still genuine persistence behavior that would survive beyond the current session and could be abused if invoked without fully informed consent or through social engineering.

Content

Scanner excerpt · references/recorder-security.md (reported line 56)May include surrounding context.

--bin /absolute/path/to/token-stats --timezone Asia/Shanghai

text

Preview verifies hashes and prints a plan without executing the CLI, creating directories/plists, or changing launchd. Show it to the user: source overrides, paths, hash, timezone, snapshots/retention, and immediate-start choice. Installation requires authorization for those choices.

Repeat with `--confirm` only after authorization. Minimum interval is 60 seconds, default 1,800. Registration enables periodic execution and login persistence but uses `RunAtLoad=false`. `--start-now` explicitly requests immediate execution. Without it, launchd can still run the task at its next scheduled interval.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

This section states that installation writes a plist and persistent runtime under the user's home directory, which is a classic persistence mechanism. The controls described—absolute paths, isolated Python mode, restricted PATH, and private permissions—reduce risk, but the core behavior still creates durable scheduled execution.

Content

Scanner excerpt · references/recorder-security.md (reported line 60)May include surrounding context.

md

Repeat with `--confirm` only after authorization. Minimum interval is 60 seconds, default 1,800. Registration enables periodic execution and login persistence but uses `RunAtLoad=false`. `--start-now` explicitly requests immediate execution. Without it, launchd can still run the task at its next scheduled interval.

Installation writes an owned `0600` plist and a private versioned runtime under `~/.local/state/token-stats-skill/<label>/<generation>/`. The helper and manifest are copied, so checkout edits do not silently alter installed code. The plist uses absolute Python/CLI paths, Python isolated mode, restricted PATH, and umask `077`. stdout/stderr go to `/dev/null`; minimal status goes to `~/Library/Logs/ai-token-ayalysis/<label>.status.json`.

All eight local `--*-home` flags are persisted. `--timezone` persists an explicit IANA timezone. Arbitrary shell environment variables, credentials, and proxies are not copied into the task. Source selection is not an OS-level access sandbox.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/recorder-security.md (reported line 72)May include surrounding context.

md

Old snapshots are not enabled implicitly. Passing `--run-dir "$HOME/.local/state/ai-token-ayalysis/runs"` includes that directory in explicit permission repair and also enables future snapshots. No retention means no deletion. To preserve old history without new snapshots, migrate its permissions separately with approved scoped operations instead of enabling it in the schedule.

The installer locks label operations, rechecks the plist, and attempts to restore previous registration on replacement failure. Prepared private files can remain after failure. An inability to restore launchd is an error, not a successful installation.

## Status, Stop, And Uninstall

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The text notes that stop preserves the plist and that it can register at login, meaning persistence can remain in place even after a stop action. While documented and apparently intentional, retaining a re-registerable plist can surprise users who believe stopping fully disables future execution.

Content

Scanner excerpt · references/recorder-security.md (reported line 89)May include surrounding context.

./scripts/install-launchd-token-recorder.sh --action uninstall --confirm

text

Status inspects registration; read the private status file for collection success/time. Stop unloads but preserves the plist, which can register at login. Uninstall unloads and removes only the owned plist. Both retain reports, snapshots, runtime generations, status, and the coordination lock. History/runtime removal is a separate scoped request.

## Snapshots And Retention

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/trae-cn.md (reported line 8)May include surrounding context.

md

Local recording and Trae synchronization are separate operations. Do not read login storage or run sync for a generic token-history question. Explain the account, date window, official endpoint, and local output, and obtain authorization for Trae setup/sync.

- `trae status` is offline but reads existing Trae CN / TRAE SOLO CN login metadata and returns account fingerprints and availability. Do not read or print the underlying credential file yourself.
- `trae sync` is the only network step. It uses existing credentials to query `https://api.trae.cn`, rejects redirects, and does not refresh or rewrite authentication. On expired auth, ask the user to sign in in the official application; never request a token in chat.
- `usage`, `report range`, and `sources` use local snapshots. `--refresh` is not an authorization or command to sync. The scheduler never runs `trae status` or `trae sync`.
- Snapshots exclude raw credentials, prompts, and raw API responses. Account/session identifiers are hashed. Model names, timestamps, token totals, and activity patterns remain sensitive.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/recorder-security.md (reported line 66)May include surrounding context.

md

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/recorder-security.md (reported line 72)May include surrounding context.

md

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/token_recorder.py (reported line 12)May include surrounding context.

python

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/token_recorder.py (reported line 270)May include surrounding context.

python

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/token_recorder.py (reported line 271)May include surrounding context.

python

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/token_recorder.py (reported line 273)May include surrounding context.

python

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/token_recorder.py (reported line 283)May include surrounding context.

python

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/token_recorder.py (reported line 317)May include surrounding context.

python

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/token_recorder.py (reported line 321)May include surrounding context.

python

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/token_recorder.py (reported line 324)May include surrounding context.

python

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/token_recorder.py (reported line 325)May include surrounding context.

python

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/token_recorder.py (reported line 358)May include surrounding context.

python

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/token_recorder.py (reported line 374)May include surrounding context.

python

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/token_recorder.py (reported line 376)May include surrounding context.

python

import os
from pathlib import Path
import platform
import plistlib
import re
import shutil
import stat