api-cost-tracker

This skill appears to be a local billing/usage analyzer and is largely coherent, but there are inconsistencies you should resolve before trusting it with real billing data or API keys: - Inspect the full scripts for network activity: search for imports or uses of requests, urllib, http.client, socket, or subprocess; if present, review where data is sent and to which endpoints. - Confirm whether the 'auto' mode actually reads API keys from the environment or calls provider APIs. The docs mention keys (OPENAI_API_KEY, etc.) but the manifest lists none — ask the author or open the full code to verify. - Test first on non-sensitive, synthetic billing exports to confirm behavior and outputs. - If you must provide API keys for auto-fetching, only do so after verifying the code path that uses them and ideally run the script in a restricted environment (isolated VM or container) to limit exposure. - If you want higher assurance, request the author to declare required env vars explicitly and include example runs that show remote fetches/endpoints; absence of those details lowers confidence. If you provide the rest of the script (the truncated portion), I can re-evaluate and raise the confidence level or change the verdict if network calls or credential misuse are found.