Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local LLM cost ledger, but its artifacts overstate budget enforcement and conflict about cron jobs and external notifications.
Review this carefully before installing. It may be acceptable as a simple local usage logger, but do not rely on it to stop LLM calls, enforce user quotas, or prevent billing overruns. Treat the cron and external notification claims as unresolved until the publisher documents and implements them clearly.
main.js:202Budget Controls Are Not Enforced and Accounting Accepts Invalid Values
main.js:65Corrupt or Partially Written State Silently Resets Spend Accounting
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
# Log an LLM call
llm-cost-guard log --model gpt-4o --input-tokens 1500 --output-tokens 800 --user alice
# Check current spend
llm-cost-guard status
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
# Log an LLM call
llm-cost-guard log --model gpt-4o --input-tokens 1500 --output-tokens 800 --user alice
# Check current spend
llm-cost-guard status
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Examples:
llm-cost-guard status
llm-cost-guard log --model gpt-4o --input 1500 --output 800 --user alice
llm-cost-guard report month
llm-cost-guard set-limit daily 5.00
llm-cost-guard reset today
The README makes privacy/safety-adjacent claims that conflict with documented behavior: it advertises daily reports via WhatsApp/Telegram/Discord, which necessarily implies outbound communications to external services. Misrepresenting network behavior can cause users to deploy the skill under false assumptions about data handling and notification destinations.
The README states that the skill auto-installs a daily cron job and sends external notifications, but it does not provide a clear warning that installation modifies system scheduling state and may initiate outbound messages automatically. Silent persistence-like behavior and unattended external communication increase operational and security risk, especially on shared or sensitive hosts.
The claim 'No external services. No telemetry.' contradicts earlier documentation describing cron-triggered report sending to WhatsApp and other chat platforms. This kind of inconsistency is security-relevant because operators may rely on the README to assess whether the skill performs outbound communication or leaks usage data externally.
The skill documentation states that it auto-installs a daily cron job, which modifies the user's scheduled tasks and persistence settings. Even though this is framed as a feature, silently creating scheduled jobs without clear opt-in is a security-relevant behavior because it establishes recurring execution and can surprise users or be abused for persistence.
The log command accepts a --user identifier and stores it in a JSON file under the user's home directory. While this is part of the tool's functionality, the help text only marks the field as optional and does not disclose that user-associated usage data will be retained locally.
The help output documents set-limit user <key> <USD>, implying limits are configured for a specific user. In code, cmdSetLimit does not read or store the <key> at all; it only parses args[2] into one perUserDailyCostLimit field, so the documented behavior contradicts the actual implementation.
The reset command deletes stored usage records for either the current day or all history by overwriting the data file, but it proceeds immediately based only on command-line arguments. Although the code prints a success message afterward, there is no pre-action confirmation or warning for this irreversible operation.
The command list uses very generic triggers such as "status", "report", "reset", and "watch", which are likely to collide with other skills or be invoked unintentionally in a larger agent environment. In a plugin ecosystem, underspecified commands can cause confused-deputy behavior or accidental execution of privileged actions, especially for state-changing operations like changing limits or resetting counters.