Token Cost Time

• Outcome: Pass
• Latest audit: May 28, 2026 at 1:01 PM UTC
• Version:
  0.1.3

Overview

This is a local token cost and timing utility whose local data storage is expected for its purpose, though users should know where logs are kept.

Before installing, confirm you are comfortable with local usage logs being written under ~/.token-cost-time/. Treat those files as private workflow metadata, review what fields are recorded, and delete or relocate the directory if you do not want historical usage data kept on disk.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The documentation explicitly states that the skill records execution data and, by default, writes a profile and JSONL execution log under the user's home directory, but it does not clearly warn users about this persistence behavior or its privacy implications. While this is not inherently malicious, silent local logging can expose prompts, model usage patterns, token counts, and other sensitive workflow metadata if users do not realize data is being stored on disk.

VirusTotal

No VirusTotal findings