Back to skill
Skillv1.0.0
ClawScan security
Usage Tracker · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 2, 2026, 9:42 AM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent as an instruction-only usage-logger and reporter, but it omits operational details about storage, retention, and the mentioned Telegram integration which you should review before installing.
- Guidance
- This skill is an instruction-only logger/report generator and does not request credentials, so it appears to do what it says. Before installing: (1) confirm where usage-logs/api-cells.jsonl will be created on your system and whether that location is writable and appropriately protected; (2) decide retention and rotation policies (to avoid unbounded disk growth and accidental retention of sensitive metadata); (3) if you plan to use the Telegram commands, expect to supply your own bot token and integration steps (the SKILL.md does not provide them); and (4) validate the pricing table if you rely on cost calculations. If you need the agent to avoid logging sensitive requests, ensure callers of log_usage only send token counts and not request/response content.
Review Dimensions
- Purpose & Capability
- okThe name/description (track API usage and compute costs) aligns with the SKILL.md: it defines log_usage, usage_report, and realtime_report and includes a pricing table. It does not ask for provider credentials because it appears intended to record usage events the agent or other components supply, which is coherent.
- Instruction Scope
- noteInstructions describe logging calls and generating reports and reference a storage path (usage-logs/api-cells.jsonl). They do not instruct the agent to read unrelated files or access credentials, but they also lack detail on how logs are written, rotated, or protected. The SKILL.md mentions Telegram commands but provides no integration setup (no tokens or endpoints), creating a minor inconsistency.
- Install Mechanism
- okNo install spec and no code files — lowest-risk model: nothing is written to disk by an installer. All behavior is instruction-only.
- Credentials
- okNo environment variables, credentials, or external config paths are requested. The skill does not ask for API keys or secrets; it only records metadata (provider, model, token counts, task_type), which is proportional to its purpose.
- Persistence & Privilege
- notealways is false (normal). The skill expects to persist logs to usage-logs/api-cells.jsonl — this is reasonable for a usage tracker, but the SKILL.md does not specify retention, access controls, or whether logs might contain sensitive metadata. That lack of detail is a privacy/operational note rather than a functional mismatch.