Token Usage Optimizer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:15 PM UTC
• Version: 1.0.5

Overview

This skill has a legitimate usage-monitoring purpose, but it also handles, stores, extracts, and rewrites sensitive Claude OAuth credentials in ways that require manual review.

Install only after reviewing the scripts and credential flow. This skill asks you to handle raw Claude OAuth access and refresh tokens, stores them in plaintext inside the skill directory, and may read or rewrite Claude CLI credentials. Avoid enabling the cron job or running the auto-refresh script unless you accept that behavior; add an effective .gitignore or store tokens outside the repository, and rotate tokens if they were ever committed, logged, or shared.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:44
• Finding: Arbitrary Command Execution Through Sourced Credential File<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:44-50`, `scripts/check-usage.sh:20-21`, and `scripts/refresh-token.sh:13` **Vulnerability Type**: Shell command injection through executable credential storage **Risk Level**: High ### Vulnerable Code `scripts/setup.sh:44-50`: ```bash cat > "$TOKEN_FILE" <<EOF # Claude Code OAuth Tokens # Generated: $(date) ACCESS_TOKEN="$ACCESS_TOKEN" REFRESH_TOKEN="$REFRESH_TOKEN" EOF ``` `scripts/check-usage.sh:20-21`: ```bash # Load tokens source "$TOKEN_FILE" ``` `scripts/refresh-token.sh:13`: ```bash source "$TOKEN_FILE" ``` ### Technical Analysis The setup script inserts user-provided token strings into a file formatted as a shell script. It does not escape quotation marks, command substitutions, semicolons, or other shell metacharacters. The usage and refresh scripts then execute the credential file with `source`. Consequently, `.tokens` is not treated as passive data: every shell construct in the file is evaluated with the privileges of the invoking user. For example, a malicious access-token input containing the following value can break out of the assignment: ```bash "; id > /tmp/token-skill-pwned; # ``` This produces an executable line resembling: ```bash ACCESS_TOKEN=""; id > /tmp/token-skill-pwned; #" ``` The same issue applies if another process, package update, or malicious repository contributor modifies `.tokens` after setup. ### Attack Path 1. An attacker persuades a user to enter a crafted token, supplies a preconfigured `.tokens` file, or gains the ability to modify that file. 2. The attacker inserts shell syntax into `ACCESS_TOKEN`, `REFRESH_TOKEN`, or another line in the file. 3. The user runs `scripts/check-usage.sh`, `scripts/report.sh`, or `scripts/refresh-token.sh`. 4. The affected script executes `source "$TOKEN_FILE"`. 5. The attacker's commands execute as the user running the Skill. ### Impact Assessment Successful exploitation provides arbitrary command exec ...[truncated 368 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never execute credential files with `source`. - Store credentials in a non-executable structured format such as JSON. - Parse the file with a JSON parser and return only expected string fields. - Validate tokens against the documented token format and reject newlines, quotes, shell metacharacters, or malformed prefixes. - Create the credential file atomically with mode `0600`. - Prefer an operating-system credential store over repository-local plaintext storage. - If an environment-file format must be retained, use a dedicated parser that treats all values as data rather than shell syntax. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:44
• Finding: OAuth Credentials May Be Accidentally Committed Because the Promised Git Ignore Rule Is Missing<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:44-52` and `SKILL.md:169-173` **Vulnerability Type**: Plaintext sensitive credential storage and misleading repository-exclusion assurance **Risk Level**: High ### Vulnerable Code `scripts/setup.sh:44-52`: ```bash cat > "$TOKEN_FILE" <<EOF # Claude Code OAuth Tokens # Generated: $(date) ACCESS_TOKEN="$ACCESS_TOKEN" REFRESH_TOKEN="$REFRESH_TOKEN" EOF chmod 600 "$TOKEN_FILE" ``` `SKILL.md:169-173`: ```markdown ## Privacy Tokens are stored in `{baseDir}/.tokens` (gitignored). Never share your access/refresh tokens. ``` ### Technical Analysis The setup process stores both the access token and the longer-lived refresh token in plaintext at `.tokens` in the project root. Although documentation says that this file is “gitignored,” the audited directory structure contains no `.gitignore` file. File mode `0600` protects the file from direct access by other local users, but it does not stop Git from staging and committing it. Because the file is created inside the repository, ordinary commands such as `git add .` can include the credentials. Retaining a refresh token also exceeds what is required for the primary usage-query operation, which only transmits the access token. The included refresh helper does not implement token refresh. ### Attack Path 1. The user runs `scripts/setup.sh`. 2. The script writes the Claude access and refresh tokens to `.tokens` in the repository root. 3. The user relies on the documentation's statement that the file is ignored. 4. The user runs a broad staging command such as `git add .`, commits the project, or uploads the directory. 5. The `.tokens` file is published to a Git remote, archive, backup, or artifact store. 6. Anyone with access to that location can recover the credentials. ### Impact Assessment Exposure of the access token can permit unauthorized use of the associated Claude session or APIs within the token's scope and lifetime. Exposure of t ...[truncated 261 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Add a project-level `.gitignore` containing at least: ```gitignore .tokens .tokens.* ``` - Store credentials outside the repository, for example under a user configuration directory with mode `0700` on the directory and `0600` on the file. - Prefer the platform credential manager or the existing Claude credential store where a supported interface exists. - Do not request or retain the refresh token unless a documented, necessary refresh operation is implemented. - Add a setup-time check that refuses to store credentials in a Git working tree unless an effective ignore rule is verified with `git check-ignore`. - Document credential rotation steps for users who may already have committed `.tokens`. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/auto-refresh-cron.sh:33
• Finding: Scheduled Health Check Overwrites the Claude CLI Credential Store<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auto-refresh-cron.sh:33-49` **Vulnerability Type**: Excessive credential-store access and unsafe code generation **Risk Level**: Medium ### Vulnerable Code ```bash # Sync to ~/.claude/.credentials.json if needed if [ -f ~/.claude/.credentials.json ]; then REFRESH_TOKEN=$(grep REFRESH_TOKEN "$TOKEN_FILE" | cut -d'=' -f2) EXPIRES_AT=$(($(date +%s) * 1000 + 3600000)) # +1 hour python3 << PYTHON_EOF import json, os creds_file = os.path.expanduser('~/.claude/.credentials.json') try: with open(creds_file, 'r') as f: creds = json.load(f) creds['claudeAiOauth']['accessToken'] = "$ACCESS_TOKEN" creds['claudeAiOauth']['refreshToken'] = "$REFRESH_TOKEN" creds['claudeAiOauth']['expiresAt'] = $EXPIRES_AT with open(creds_file, 'w') as f: json.dump(creds, f, indent=2) os.chmod(creds_file, 0o600) except Exception as e: pass # Silent fail - not critical PYTHON_EOF fi ``` ### Technical Analysis The declared purpose of this script is to test token health and alert when manual refresh is required. That operation requires reading a token and making an authenticated API request; it does not require modifying the canonical Claude CLI credential store. Nevertheless, after a successful health check, the script overwrites the CLI access token, refresh token, and expiry time using values from the project-local `.tokens` file. It also fabricates an expiry value one hour in the future instead of preserving authoritative token metadata. Because `ACCESS_TOKEN` and `REFRESH_TOKEN` are interpolated directly into an unquoted Python heredoc, crafted content in `.tokens` can also change the generated Python source. Exceptions are silently discarded, concealing corruption and failures. The documentation recommends recurring execution every 30 minutes. Although the scheduling mechanism is disclosed, recurring execution magnifies the effect of the excessive credential-store wri ...[truncated 1071 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove all writes to `~/.claude/.credentials.json` from the health-check script. - Restrict the health check to reading the configured access token and querying the documented Anthropic endpoint. - If synchronization is genuinely required, implement it as a separate, explicit, opt-in operation with clear user confirmation. - Use a supported Claude CLI or authentication API instead of modifying private credential files directly. - Never interpolate credential strings into generated Python source. Pass values through environment variables, standard input, or structured JSON and parse them as data. - Preserve authoritative expiry metadata rather than inventing a replacement value. - Fail visibly and safely on parsing or write errors instead of silently swallowing exceptions. - Validate ownership, type, and permissions before accessing any credential file. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check-usage.sh:8
• Finding: Predictable Shared Temporary Files Allow Symlink-Based File Overwrites and Report Manipulation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/check-usage.sh:8-10, 111-130`, `scripts/auto-refresh-cron.sh:7, 30, 72`, and `scripts/report.sh:13-15` **Vulnerability Type**: Unsafe predictable temporary-file handling **Risk Level**: Medium ### Vulnerable Code `scripts/check-usage.sh:8-10`: ```bash CACHE_FILE="${CACHE_FILE:-/tmp/claude-usage.cache}" STATE_FILE="${STATE_FILE:-/tmp/claude-usage-alert-state}" CACHE_TTL="${CACHE_TTL:-600}" # 10 minutes default ``` `scripts/check-usage.sh:111-116`: ```bash # Save to cache echo "SESSION=${SESSION:-0}" > "$CACHE_FILE" echo "WEEKLY=${WEEKLY:-0}" >> "$CACHE_FILE" echo "BURN_RATE=${BURN_RATE}" >> "$CACHE_FILE" echo "CACHED_AT=$(date +%s)" >> "$CACHE_FILE" ``` `scripts/check-usage.sh:127-130`: ```bash # Update state echo "LAST_SESSION=${SESSION:-0}" > "$STATE_FILE" # Output cat "$CACHE_FILE" ``` `scripts/auto-refresh-cron.sh:7`: ```bash ALERT_STATE="/tmp/claude-oauth-refresh-alert" ``` `scripts/auto-refresh-cron.sh:30`: ```bash rm -f "$ALERT_STATE" ``` `scripts/auto-refresh-cron.sh:72`: ```bash date > "$ALERT_STATE" ``` `scripts/report.sh:13-15`: ```bash SESSION=$(grep "^SESSION=" /tmp/claude-usage.cache | cut -d= -f2) WEEKLY=$(grep "^WEEKLY=" /tmp/claude-usage.cache | cut -d= -f2) BURN_RATE=$(grep "^BURN_RATE=" /tmp/claude-usage.cache | cut -d= -f2) ``` ### Technical Analysis The scripts use fixed, globally predictable paths under the shared `/tmp` directory. They do not create a private directory, verify ownership, reject symbolic links, or perform atomic file replacement. Shell output redirection follows symbolic links. Therefore, another local process can pre-create one of these paths as a symbolic link to a file writable by the victim. When the Skill runs, its redirections may truncate and overwrite that target. A local process can also populate the cache with fabricated values. The reporting script trusts the fixed cache path, which allows false usage percentages or alert state to ...[truncated 1133 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Store runtime state in a user-private directory such as `${XDG_RUNTIME_DIR}`. - If no private runtime directory exists, create one with `mktemp -d` and permissions `0700`. - Verify that state files are regular files owned by the current user and reject symbolic links. - Set a restrictive `umask`, such as `umask 077`, before creating cache or state files. - Write to a securely created temporary file and atomically rename it into place. - Make `report.sh` consume the exact cache path selected by `check-usage.sh` rather than independently trusting a hardcoded global path. - Do not run these scripts with elevated privileges. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (50)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared use case is plan utilization reporting, but the file documents access to local token storage and authentication maintenance tasks unrelated to simple usage analytics. In security terms, this hidden expansion of scope is dangerous because credential access is far more sensitive than reporting and can enable account misuse if mishandled.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared use case is plan utilization reporting, but the file documents access to local token storage and authentication maintenance tasks unrelated to simple usage analytics. In security terms, this hidden expansion of scope is dangerous because credential access is far more sensitive than reporting and can enable account misuse if mishandled.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared use case is plan utilization reporting, but the file documents access to local token storage and authentication maintenance tasks unrelated to simple usage analytics. In security terms, this hidden expansion of scope is dangerous because credential access is far more sensitive than reporting and can enable account misuse if mishandled.

Credential Access

High

• Category: Privilege Escalation

Content

```

You'll need:
- **Access Token** (`sk-ant-oat01-...`)
- **Refresh Token** (`sk-ant-ort01-...`)

See `references/token-extraction.md` for how to get these.

• Confidence: 94% confidence
• Finding: The skill requests both access and refresh tokens directly from the user, which are highly sensitive credentials capable of authenticating API requests and extending access. Handling refresh tokens is especially risky because they can prolong account access even after short-lived access tokens expire.

Credential Access

High

• Category: Privilege Escalation

Content

### v1.0.5 (2026-02-22)
- 🐛 **Bugfix:** Fixed token extraction in `auto-refresh-cron.sh` (removed quotes handling)
- ⚡ **Performance:** Reduced cron interval from 1h to 30m for more reliable token refresh
- 📝 Improved reliability of OAuth token sync with `~/.claude/.credentials.json`

### v1.0.4 (2026-02-21)
- 🔄 Replaced automatic refresh with health check + manual refresh workflow

• Confidence: 95% confidence
• Finding: The changelog explicitly references syncing with ~/.claude/.credentials.json, indicating the skill's broader credential-access behavior. Accessing or extracting tokens from local credential stores materially raises sensitivity because compromise, accidental disclosure, or parsing mistakes could expose reusable authentication secrets.

Credential Access

High

• Category: Privilege Escalation

Content

}
```

**Cause:** Invalid or expired access token

**Fix:** Use refresh token to get new access token

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

}
```

**Cause:** Invalid or expired access token

**Fix:** Use refresh token to get new access token

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The guide explicitly tells users to open auth files and extract access and refresh tokens, but does not clearly state that these credentials can grant account access and must only be handled in a trusted local environment. This omission increases the chance users will expose long-lived or refreshable secrets to logs, shell history, screenshots, assistants, or untrusted tools.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

2. **Find the auth file:**
   ```bash
   # Try these locations:
   cat ~/.claude/auth.json
   cat ~/Library/Application\ Support/Claude/auth.json
   
   # Or search:

• Confidence: 88% confidence
• Finding: The instructions direct users to read files in the Claude configuration directory that contain authentication secrets. Accessing agent config paths is especially sensitive because these locations commonly store reusable credentials, and the guidance normalizes direct secret inspection.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

```bash
   # Common locations:
   cat ~/.config/claude/auth.json
   cat ~/.claude/auth.json
   
   # Or use secret-tool:
   secret-tool search application "Claude Code"

• Confidence: 88% confidence
• Finding: The Linux instructions similarly direct users to inspect config directories and secret storage locations for Claude authentication data. This expands the skill into credential discovery behavior and increases the likelihood of exposing reusable secrets.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The Browser DevTools method instructs users to inspect local storage and copy auth token values without a direct warning about credential exposure. Browser storage often contains active bearer tokens, so encouraging manual copying significantly raises the risk of accidental compromise.

Credential Access

High

• Category: Privilege Escalation

Content

## Token Format

- **Access Token:** `sk-ant-oat01-...` (long alphanumeric string)
- **Refresh Token:** `sk-ant-ort01-...` (long alphanumeric string)

## Security

• Confidence: 94% confidence
• Finding: The token format section explicitly describes the structure of access and refresh tokens and reinforces that the skill expects users to handle live credentials directly. In the context of a usage-monitoring skill, this normalizes credential access and can facilitate harvesting or mishandling of sensitive authentication material.

Credential Access

High

• Category: Privilege Escalation

Content

## Token Expiry

- Access tokens expire after a certain time
- Use refresh token to get a new access token
- This skill doesn't auto-refresh yet (manual re-run of setup required)

• Confidence: 86% confidence
• Finding: Explaining access-token expiry and refresh-token use is not inherently dangerous, but here it appears in a document already focused on manual token extraction and storage. That context makes it part of a workflow for maintaining unauthorized or fragile direct credential handling rather than a safe integration pattern.

Credential Access

High

• Category: Privilege Escalation

Content

## Token Expiry

- Access tokens expire after a certain time
- Use refresh token to get a new access token
- This skill doesn't auto-refresh yet (manual re-run of setup required)

## Troubleshooting

• Confidence: 86% confidence
• Finding: Telling users to use the refresh token to obtain a new access token extends the lifetime and utility of any exposed credential set. In a skill context that already encourages manual token retrieval, this increases the risk that compromised secrets can continue to grant account access.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script performs OAuth token health checks and synchronizes credentials into ~/.claude/.credentials.json, which goes beyond the declared quota-monitoring purpose of the skill. This scope expansion is dangerous because it introduces credential-handling behavior that can modify a user's authentication state and creates unnecessary access to sensitive tokens.

Credential Access

High

• Category: Privilege Escalation

Content

TOKEN_FILE="$BASE_DIR/.tokens"
ALERT_STATE="/tmp/claude-oauth-refresh-alert"

# Extract current access token
if [ ! -f "$TOKEN_FILE" ]; then
  echo "❌ Token file not found: $TOKEN_FILE" >&2
  exit 1

• Confidence: 90% confidence
• Finding: The script is designed to access a local token file and extract an access token, which is credential access. Reading an access token is not inherently malicious, but in this skill context it expands the trust boundary and becomes risky because the tool is nominally for quota optimization rather than auth management.

Credential Access

High

• Category: Privilege Escalation

Content

ACCESS_TOKEN=$(grep ACCESS_TOKEN "$TOKEN_FILE" | cut -d'=' -f2)

if [ -z "$ACCESS_TOKEN" ]; then
  echo "❌ Could not extract access token" >&2
  exit 1
fi

• Confidence: 91% confidence
• Finding: This line extracts the bearer access token from a local file for subsequent authenticated API use. Although that may be functionally necessary for usage checks, it still constitutes sensitive credential handling and is more concerning here because the same script also performs credential synchronization beyond the stated purpose.

Credential Access

High

• Category: Privilege Escalation

Content

rm -f "$ALERT_STATE"
  echo "✅ OAuth token is valid"
  
  # Sync to ~/.claude/.credentials.json if needed
  if [ -f ~/.claude/.credentials.json ]; then
    REFRESH_TOKEN=$(grep REFRESH_TOKEN "$TOKEN_FILE" | cut -d'=' -f2)
    EXPIRES_AT=$(($(date +%s) * 1000 + 3600000))  # +1 hour

• Confidence: 96% confidence
• Finding: The script accesses the user's Claude credential store and prepares to synchronize tokens into it, which is privileged credential access unrelated to simple monitoring. In this skill context, credential manipulation is more dangerous because users would not reasonably expect a quota tool to touch persistent auth files.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code reads refresh tokens from a local token file and rewrites Claude authentication credentials in ~/.claude/.credentials.json. A usage optimizer does not need authority to alter auth material, so this behavior creates an unnecessary and risky capability that could corrupt credentials, extend access, or be repurposed for account persistence.

Credential Access

High

• Category: Privilege Escalation

Content

echo "✅ OAuth token is valid"
  
  # Sync to ~/.claude/.credentials.json if needed
  if [ -f ~/.claude/.credentials.json ]; then
    REFRESH_TOKEN=$(grep REFRESH_TOKEN "$TOKEN_FILE" | cut -d'=' -f2)
    EXPIRES_AT=$(($(date +%s) * 1000 + 3600000))  # +1 hour

• Confidence: 96% confidence
• Finding: This code reads a refresh token from the local token file specifically to update another credential store. Refresh tokens are highly sensitive because they can mint new access tokens, so handling them in a utility script significantly raises the risk of credential compromise or unauthorized persistence.

Credential Access

High

• Category: Privilege Escalation

Content

python3 << PYTHON_EOF
import json, os
creds_file = os.path.expanduser('~/.claude/.credentials.json')
try:
    with open(creds_file, 'r') as f:
        creds = json.load(f)

• Confidence: 98% confidence
• Finding: The embedded Python code opens, parses, and rewrites ~/.claude/.credentials.json, directly manipulating persistent authentication data. This is dangerous because any bug, tampering, or later code change could overwrite valid credentials, implant attacker-controlled tokens, or silently maintain access without the user's awareness.

Credential Access

High

• Category: Privilege Escalation

Content

# Check if claude CLI is available (handles auto-refresh automatically)
if command -v claude >/dev/null 2>&1; then
  # Claude CLI available - use it to get fresh token
  # It will auto-refresh if needed and update ~/.claude/.credentials.json
  
  # Trigger a simple query to ensure token is fresh
  echo "ping" | claude --quiet >/dev/null 2>&1 || true

• Confidence: 93% confidence
• Finding: The script deliberately triggers the Claude CLI so that credential state in ~/.claude/.credentials.json is refreshed and becomes available for later extraction. Using another tool's credential store as an implicit auth source broadens secret access and is particularly sensitive because this skill only claims to monitor usage, not manage authentication internals.

Credential Access

High

• Category: Privilege Escalation

Content

echo "ping" | claude --quiet >/dev/null 2>&1 || true
  
  # Extract fresh token from credentials file
  if [ -f ~/.claude/.credentials.json ]; then
    FRESH_TOKEN=$(python3 -c "import json; d=json.load(open('$HOME/.claude/.credentials.json')); print(d.get('claudeAiOauth', {}).get('accessToken', ''))" 2>/dev/null)
    if [ -n "$FRESH_TOKEN" ]; then
      ACCESS_TOKEN="$FRESH_TOKEN"

• Confidence: 96% confidence
• Finding: The script checks for and accesses ~/.claude/.credentials.json to harvest an access token, which is direct credential access to another application's local secret store. In an agent skill, this is dangerous because it enables hidden secret collection and reuse beyond the minimum necessary behavior advertised to the user.

Credential Access

High

• Category: Privilege Escalation

Content

# Extract fresh token from credentials file
  if [ -f ~/.claude/.credentials.json ]; then
    FRESH_TOKEN=$(python3 -c "import json; d=json.load(open('$HOME/.claude/.credentials.json')); print(d.get('claudeAiOauth', {}).get('accessToken', ''))" 2>/dev/null)
    if [ -n "$FRESH_TOKEN" ]; then
      ACCESS_TOKEN="$FRESH_TOKEN"
      # Update .tokens file for consistency

• Confidence: 97% confidence
• Finding: The embedded Python command extracts the accessToken field from ~/.claude/.credentials.json, which is explicit secret exfiltration into script memory and then potentially into another file. This is high risk because it directly handles bearer credentials that can be reused for authenticated API access if exposed.

Credential Access

High

• Category: Privilege Escalation

Content

fi
fi

# Prompt for access token
echo "1️⃣  Enter your Access Token (sk-ant-oat01-...):"
read -r ACCESS_TOKEN

• Confidence: 90% confidence
• Finding: The script prompts directly for an OAuth access token, meaning the skill is performing credential collection rather than delegating authentication to a trusted provider flow. In the context of a usage optimizer, this is more dangerous because users may be conditioned to paste high-value secrets into an untrusted local script for a convenience feature.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api-endpoint.md:22