Claude Usage Release

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is purpose-aligned: it launches your authenticated Claude Code CLI to run `/usage` and report quota information, with no evidence of account changes or data exfiltration.

Before installing, be comfortable with your agent launching the local Claude Code CLI under your logged-in account and returning usage metrics. The artifacts do not show billing changes, plan changes, persistence, or exfiltration, but the registry metadata under-declares the external CLI/authentication requirements.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may launch Claude Code on your machine and interact with it to retrieve plan usage.

Why it was flagged

The skill instructs the agent to automate an interactive local CLI session. This is disclosed and directly tied to checking usage, but it is still local tool automation.

Skill content

expect -c '\n   spawn claude\n   expect "Welcome"\n   send "/usage\r"

Recommendation

Use only if you are comfortable with the agent running this bounded `/usage` workflow through your local Claude Code CLI.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can access usage information for the Claude account currently authenticated in Claude Code.

Why it was flagged

The skill depends on an already-authenticated Claude account session to retrieve subscription usage.

Skill content

**Claude Code CLI** must be installed and authenticated

Recommendation

Confirm the authenticated Claude Code account is the one you intend to check, and avoid using the skill on shared machines or accounts if usage data is sensitive.

Low

#ASI06: Memory and Context Poisoning

What this means

If the main interactive flow is unavailable, the agent may read local Claude usage cache data and summarize it back to you.

Why it was flagged

The documented fallback reads a persistent local Claude cache containing usage/token-count information.

Skill content

`~/.claude/stats-cache.json` - shows local session token counts (limited data)

Recommendation

Treat returned usage/token-count information as private account activity data, and ensure local cache access is acceptable before using the fallback.