Gateway
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code, instructions, and requirements are internally consistent with a local pre-call budget/guard plugin and do not request unrelated credentials or installs.
This plugin appears to do exactly what it says: locally estimate tokens/costs and block or downgrade requests. Before installing, consider: (1) Keep debug:false in production to avoid logging sensitive inputs; the redaction is shallow (only top-level keys), so nested secrets in logged objects could leak. (2) Provide accurate sessionSpentUsd from your accounting to avoid false allows/blocks. (3) Review the model pricing table and aliases to ensure they match your providers/prices. (4) Run the included tests and, if you plan to expose logs to shared systems, audit them to ensure nothing sensitive is emitted.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings