CostLens
PassAudited by ClawScan on May 1, 2026.
Overview
CostLens is a coherent offline cost-reporting CLI; users should mainly verify the log and report paths and trust the event data they feed into it.
CostLens appears safe for its stated offline cost-reporting purpose. Before installing or using it, make sure you trust the JSON event logs, verify `--events` and `--out` paths, and review reports before sharing them or using them in automated budget gates.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If invoked with the wrong paths, the skill could read an unintended local JSON file or overwrite/create a report in an unintended location.
The tool reads the caller-provided events file and writes a caller-provided report path. This is expected for an offline reporting CLI, but path selection matters.
const raw = JSON.parse(fs.readFileSync(resolved, 'utf8')); ... fs.writeFileSync(resolved, `${JSON.stringify(report, null, 2)}\n`, 'utf8');Confirm the `--events` and `--out` paths before running, and use a dedicated reports directory for generated output.
A bad or manipulated event log could understate or overstate costs, which matters if the output is used as a CI or automation budget gate.
Event-provided rate override fields directly influence cost and budget calculations. This is documented behavior, but it means untrusted or malformed event logs can skew budget results.
inputPer1k: toNumber(event.inputCostPer1k, base.inputPer1k), outputPer1k: toNumber(event.outputCostPer1k, base.outputPer1k)
Use trusted event exports, and consider stripping or validating per-event rate overrides before relying on CostLens for automated budget enforcement.
Generated reports may contain details from invalid log entries, which could include sensitive or prompt-like data if the original logs include more than token counts.
Malformed events can be copied into generated JSON output or reports. This is useful for diagnostics, but it can preserve raw log-derived content.
invalidEvents.push({ event, reason: 'Invalid event structure' }); ... invalidEvents: summary.invalidEventsTreat exported reports as log-derived artifacts, redact sensitive fields before sharing, and avoid feeding unreviewed reports back into agents as authoritative instructions.