Task Cost Estimator

Task to best model + cost. 4 modes (value, quality, balanced, local). Tracks lifetime Bonus.

Security Scan

The skill's description is plausible, but its runtime instructions expect undisclosed command-line tools and an unspecified tracking endpoint, making it internally inconsistent and unclear about where data goes.

Purpose & Capability

The name/description claim a model picker + cost estimator, which is reasonable; however the SKILL.md instructs the agent to run a 'task-cost' CLI and an 'api-cost' tracking command even though the skill declares no required binaries, installs, or credentials. That mismatch (instructions require binaries but none are declared) is incoherent: either the skill omitted required runtime components or it expects tools that may not exist or be trusted.

Instruction Scope

Runtime instructions tell the agent to execute 'task-cost -q ...' variants and to run 'api-cost track $amt provider model' after tasks. The doc does not define what those binaries do, where 'api-cost' sends tracking data, or whether any credentials/configuration are needed. This exposes a risk that cost/usage data could be sent to an unknown endpoint or that the agent will attempt to run absent/untrusted binaries. Triggers are broad (many common verbs and phrases), increasing the chance of unintended invocation.

Install Mechanism

This is an instruction-only skill (no install spec, no code files), which is low-risk by itself. However, it's notable that the instructions require command-line tools even though there is no install or provenance information for them; that omission is an operational inconsistency rather than an install-time risk from this package.

Credentials

The skill declares no required environment variables or credentials, but the 'api-cost track' step implies it may need credentials or an endpoint to record costs. Because those are not declared, there's a mismatch: either the tool is expected to be locally configured (but that configuration is unspecified) or the instructions would prompt the agent to access external services without made explicit what secrets/configs are required.

Persistence & Privilege

always is false and there is no install-time persistence or modifications to other skills. The skill does not request elevated or permanent presence in the agent environment.

What to consider before installing

This skill's idea is reasonable, but the SKILL.md expects two CLI tools ('task-cost' and 'api-cost') without declaring them or explaining where they come from or what 'api-cost track' does. Before installing or enabling this skill: (1) ask the publisher for the source or binary provenance for 'task-cost' and 'api-cost' (links to repos/releases); (2) confirm what endpoint 'api-cost' uses and whether it requires credentials—do not provide secrets until you know where they go; (3) consider that the broad trigger list may cause frequent/accidental runs; (4) if you cannot verify the tools' origin and behavior, do not enable autonomous invocation or decline to install the skill. Additional information that would raise confidence: a repo or package link for the CLIs, an explicit list of required env vars/credentials, and documentation of the tracking endpoint and data sent.

task-cost — model picker + cost estimator

Triggers

When user says: build, create, write, debug, fix, implement, design, research, analyze, refactor, optimize, "how much", "cost", "which model", task-cost, bonus

Run (always with -q)

task-cost -q "<task>"
task-cost -q --quality "<task>"  # critical
task-cost -q --local "<task>"    # open-source
task-cost --bonus

Post-task

api-cost track $amt provider model