Token Usage Optimizer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:15 PM UTC
• Version: 1.0.5

Overview

This skill has a legitimate usage-monitoring purpose, but it also handles, stores, extracts, and rewrites sensitive Claude OAuth credentials in ways that require manual review.

Install only after reviewing the scripts and credential flow. This skill asks you to handle raw Claude OAuth access and refresh tokens, stores them in plaintext inside the skill directory, and may read or rewrite Claude CLI credentials. Avoid enabling the cron job or running the auto-refresh script unless you accept that behavior; add an effective .gitignore or store tokens outside the repository, and rotate tokens if they were ever committed, logged, or shared.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:44

Finding

Arbitrary Command Execution Through Sourced Credential File

Content

View full analysis

"$TOKEN_FILE" < /tmp/token-skill-pwned; # ``` This produces an executable line resembling: ```bash ACCESS_TOKEN=""; id > /tmp/token-skill-pwned; #" ``` The same issue applies if another process, package update, or malicious repository contributor modifies `.tokens` after setup. ### Attack Path 1. An attacker persuades a user to enter a crafted token, supplies a preconfigured `.tokens` file, or gains the ability to modify that file. 2. The attacker inserts shell syntax into `ACCESS_TOKEN`, `REFRESH_TOKEN`, or another line in the file. 3. The user runs `scripts/check-usage.sh`, `scripts/report.sh`, or `scripts/refresh-token.sh`. 4. The affected script executes `source "$TOKEN_FILE"`. 5. The attacker's commands execute as the user running the Skill. ### Impact Assessment Successful exploitation provides arbitrary command exec ...[truncated 368 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:44

Finding

OAuth Credentials May Be Accidentally Committed Because the Promised Git Ignore Rule Is Missing

Content

View full analysis

"$TOKEN_FILE" <

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/auto-refresh-cron.sh:33

Finding

Scheduled Health Check Overwrites the Claude CLI Credential Store

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check-usage.sh:8

Finding

Predictable Shared Temporary Files Allow Symlink-Based File Overwrites and Report Manipulation

Content

View full analysis

"$CACHE_FILE" echo "WEEKLY=${WEEKLY:-0}" >> "$CACHE_FILE" echo "BURN_RATE=${BURN_RATE}" >> "$CACHE_FILE" echo "CACHED_AT=$(date +%s)" >> "$CACHE_FILE" ``` `scripts/check-usage.sh:127-130`: ```bash # Update state echo "LAST_SESSION=${SESSION:-0}" > "$STATE_FILE" # Output cat "$CACHE_FILE" ``` `scripts/auto-refresh-cron.sh:7`: ```bash ALERT_STATE="/tmp/claude-oauth-refresh-alert" ``` `scripts/auto-refresh-cron.sh:30`: ```bash rm -f "$ALERT_STATE" ``` `scripts/auto-refresh-cron.sh:72`: ```bash date > "$ALERT_STATE" ``` `scripts/report.sh:13-15`: ```bash SESSION=$(grep "^SESSION=" /tmp/claude-usage.cache | cut -d= -f2) WEEKLY=$(grep "^WEEKLY=" /tmp/claude-usage.cache | cut -d= -f2) BURN_RATE=$(grep "^BURN_RATE=" /tmp/claude-usage.cache | cut -d= -f2) ``` ### Technical Analysis The scripts use fixed, globally predictable paths under the shared `/tmp` directory. They do not create a private directory, verify ownership, reject symbolic links, or perform atomic file replacement. Shell output redirection follows symbolic links. Therefore, another local process can pre-create one of these paths as a symbolic link to a file writable by the victim. When the Skill runs, its redirections may truncate and overwrite that target. A local process can also populate the cache with fabricated values. The reporting script trusts the fixed cache path, which allows false usage percentages or alert state to ...[truncated 1133 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (50)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared use case is plan utilization reporting, but the file documents access to local token storage and authentication maintenance tasks unrelated to simple usage analytics. In security terms, this hidden expansion of scope is dangerous because credential access is far more sensitive than reporting and can enable account misuse if mishandled.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared use case is plan utilization reporting, but the file documents access to local token storage and authentication maintenance tasks unrelated to simple usage analytics. In security terms, this hidden expansion of scope is dangerous because credential access is far more sensitive than reporting and can enable account misuse if mishandled.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared use case is plan utilization reporting, but the file documents access to local token storage and authentication maintenance tasks unrelated to simple usage analytics. In security terms, this hidden expansion of scope is dangerous because credential access is far more sensitive than reporting and can enable account misuse if mishandled.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill requests both access and refresh tokens directly from the user, which are highly sensitive credentials capable of authenticating API requests and extending access. Handling refresh tokens is especially risky because they can prolong account access even after short-lived access tokens expire.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

text

You'll need:
- **Access Token** (`sk-ant-oat01-...`)
- **Refresh Token** (`sk-ant-ort01-...`)

See `references/token-extraction.md` for how to get these.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The changelog explicitly references syncing with ~/.claude/.credentials.json, indicating the skill's broader credential-access behavior. Accessing or extracting tokens from local credential stores materially raises sensitivity because compromise, accidental disclosure, or parsing mistakes could expose reusable authentication secrets.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

md

### v1.0.5 (2026-02-22)
- 🐛 **Bugfix:** Fixed token extraction in `auto-refresh-cron.sh` (removed quotes handling)
- ⚡ **Performance:** Reduced cron interval from 1h to 30m for more reliable token refresh
- 📝 Improved reliability of OAuth token sync with `~/.claude/.credentials.json`

### v1.0.4 (2026-02-21)
- 🔄 Replaced automatic refresh with health check + manual refresh workflow

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-endpoint.md (reported line 105)May include surrounding context.

}

text

**Cause:** Invalid or expired access token

**Fix:** Use refresh token to get new access token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-endpoint.md (reported line 107)May include surrounding context.

}

text

**Cause:** Invalid or expired access token

**Fix:** Use refresh token to get new access token

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide explicitly tells users to open auth files and extract access and refresh tokens, but does not clearly state that these credentials can grant account access and must only be handled in a trusted local environment. This omission increases the chance users will expose long-lived or refreshable secrets to logs, shell history, screenshots, assistants, or untrusted tools.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 88% confidence

Finding

The instructions direct users to read files in the Claude configuration directory that contain authentication secrets. Accessing agent config paths is especially sensitive because these locations commonly store reusable credentials, and the guidance normalizes direct secret inspection.

Content

Scanner excerpt · references/token-extraction.md (reported line 17)May include surrounding context.

2. Find the auth file:

   bash

   # Try these locations:
   cat ~/.claude/auth.json
   cat ~/Library/Application\ Support/Claude/auth.json
   
   # Or search:
   

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 88% confidence

Finding

The Linux instructions similarly direct users to inspect config directories and secret storage locations for Claude authentication data. This expands the skill into credential discovery behavior and increases the likelihood of exposing reusable secrets.

Content

Scanner excerpt · references/token-extraction.md (reported line 44)May include surrounding context.

bash

   # Common locations:
   cat ~/.config/claude/auth.json
   cat ~/.claude/auth.json
   
   # Or use secret-tool:
   secret-tool search application "Claude Code"

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The Browser DevTools method instructs users to inspect local storage and copy auth token values without a direct warning about credential exposure. Browser storage often contains active bearer tokens, so encouraging manual copying significantly raises the risk of accidental compromise.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The token format section explicitly describes the structure of access and refresh tokens and reinforces that the skill expects users to handle live credentials directly. In the context of a usage-monitoring skill, this normalizes credential access and can facilitate harvesting or mishandling of sensitive authentication material.

Content

Scanner excerpt · references/token-extraction.md (reported line 86)May include surrounding context.

md

## Token Format

- **Access Token:** `sk-ant-oat01-...` (long alphanumeric string)
- **Refresh Token:** `sk-ant-ort01-...` (long alphanumeric string)

## Security

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

Explaining access-token expiry and refresh-token use is not inherently dangerous, but here it appears in a document already focused on manual token extraction and storage. That context makes it part of a workflow for maintaining unauthorized or fragile direct credential handling rather than a safe integration pattern.

Content

Scanner excerpt · references/token-extraction.md (reported line 99)May include surrounding context.

md

## Token Expiry

- Access tokens expire after a certain time
- Use refresh token to get a new access token
- This skill doesn't auto-refresh yet (manual re-run of setup required)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

Telling users to use the refresh token to obtain a new access token extends the lifetime and utility of any exposed credential set. In a skill context that already encourages manual token retrieval, this increases the risk that compromised secrets can continue to grant account access.

Content

Scanner excerpt · references/token-extraction.md (reported line 100)May include surrounding context.

md

## Token Expiry

- Access tokens expire after a certain time
- Use refresh token to get a new access token
- This skill doesn't auto-refresh yet (manual re-run of setup required)

## Troubleshooting

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script performs OAuth token health checks and synchronizes credentials into ~/.claude/.credentials.json, which goes beyond the declared quota-monitoring purpose of the skill. This scope expansion is dangerous because it introduces credential-handling behavior that can modify a user's authentication state and creates unnecessary access to sensitive tokens.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The script is designed to access a local token file and extract an access token, which is credential access. Reading an access token is not inherently malicious, but in this skill context it expands the trust boundary and becomes risky because the tool is nominally for quota optimization rather than auth management.

Content

Scanner excerpt · scripts/auto-refresh-cron.sh (reported line 9)May include surrounding context.

sh

TOKEN_FILE="$BASE_DIR/.tokens"
ALERT_STATE="/tmp/claude-oauth-refresh-alert"

# Extract current access token
if [ ! -f "$TOKEN_FILE" ]; then
  echo "❌ Token file not found: $TOKEN_FILE" >&2
  exit 1

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

This line extracts the bearer access token from a local file for subsequent authenticated API use. Although that may be functionally necessary for usage checks, it still constitutes sensitive credential handling and is more concerning here because the same script also performs credential synchronization beyond the stated purpose.

Content

Scanner excerpt · scripts/auto-refresh-cron.sh (reported line 18)May include surrounding context.

sh

ACCESS_TOKEN=$(grep ACCESS_TOKEN "$TOKEN_FILE" | cut -d'=' -f2)

if [ -z "$ACCESS_TOKEN" ]; then
  echo "❌ Could not extract access token" >&2
  exit 1
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The script accesses the user's Claude credential store and prepares to synchronize tokens into it, which is privileged credential access unrelated to simple monitoring. In this skill context, credential manipulation is more dangerous because users would not reasonably expect a quota tool to touch persistent auth files.

Content

Scanner excerpt · scripts/auto-refresh-cron.sh (reported line 33)May include surrounding context.

sh

rm -f "$ALERT_STATE"
  echo "✅ OAuth token is valid"
  
  # Sync to ~/.claude/.credentials.json if needed
  if [ -f ~/.claude/.credentials.json ]; then
    REFRESH_TOKEN=$(grep REFRESH_TOKEN "$TOKEN_FILE" | cut -d'=' -f2)
    EXPIRES_AT=$(($(date +%s) * 1000 + 3600000))  # +1 hour

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code reads refresh tokens from a local token file and rewrites Claude authentication credentials in ~/.claude/.credentials.json. A usage optimizer does not need authority to alter auth material, so this behavior creates an unnecessary and risky capability that could corrupt credentials, extend access, or be repurposed for account persistence.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This code reads a refresh token from the local token file specifically to update another credential store. Refresh tokens are highly sensitive because they can mint new access tokens, so handling them in a utility script significantly raises the risk of credential compromise or unauthorized persistence.

Content

Scanner excerpt · scripts/auto-refresh-cron.sh (reported line 34)May include surrounding context.

sh

echo "✅ OAuth token is valid"
  
  # Sync to ~/.claude/.credentials.json if needed
  if [ -f ~/.claude/.credentials.json ]; then
    REFRESH_TOKEN=$(grep REFRESH_TOKEN "$TOKEN_FILE" | cut -d'=' -f2)
    EXPIRES_AT=$(($(date +%s) * 1000 + 3600000))  # +1 hour

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The embedded Python code opens, parses, and rewrites ~/.claude/.credentials.json, directly manipulating persistent authentication data. This is dangerous because any bug, tampering, or later code change could overwrite valid credentials, implant attacker-controlled tokens, or silently maintain access without the user's awareness.

Content

Scanner excerpt · scripts/auto-refresh-cron.sh (reported line 40)May include surrounding context.

sh

python3 << PYTHON_EOF
import json, os
creds_file = os.path.expanduser('~/.claude/.credentials.json')
try:
    with open(creds_file, 'r') as f:
        creds = json.load(f)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The script deliberately triggers the Claude CLI so that credential state in ~/.claude/.credentials.json is refreshed and becomes available for later extraction. Using another tool's credential store as an implicit auth source broadens secret access and is particularly sensitive because this skill only claims to monitor usage, not manage authentication internals.

Content

Scanner excerpt · scripts/check-usage.sh (reported line 45)May include surrounding context.

sh

# Check if claude CLI is available (handles auto-refresh automatically)
if command -v claude >/dev/null 2>&1; then
  # Claude CLI available - use it to get fresh token
  # It will auto-refresh if needed and update ~/.claude/.credentials.json
  
  # Trigger a simple query to ensure token is fresh
  echo "ping" | claude --quiet >/dev/null 2>&1 || true

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The script checks for and accesses ~/.claude/.credentials.json to harvest an access token, which is direct credential access to another application's local secret store. In an agent skill, this is dangerous because it enables hidden secret collection and reuse beyond the minimum necessary behavior advertised to the user.

Content

Scanner excerpt · scripts/check-usage.sh (reported line 51)May include surrounding context.

sh

echo "ping" | claude --quiet >/dev/null 2>&1 || true
  
  # Extract fresh token from credentials file
  if [ -f ~/.claude/.credentials.json ]; then
    FRESH_TOKEN=$(python3 -c "import json; d=json.load(open('$HOME/.claude/.credentials.json')); print(d.get('claudeAiOauth', {}).get('accessToken', ''))" 2>/dev/null)
    if [ -n "$FRESH_TOKEN" ]; then
      ACCESS_TOKEN="$FRESH_TOKEN"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The embedded Python command extracts the accessToken field from ~/.claude/.credentials.json, which is explicit secret exfiltration into script memory and then potentially into another file. This is high risk because it directly handles bearer credentials that can be reused for authenticated API access if exposed.

Content

Scanner excerpt · scripts/check-usage.sh (reported line 52)May include surrounding context.

sh

# Extract fresh token from credentials file
  if [ -f ~/.claude/.credentials.json ]; then
    FRESH_TOKEN=$(python3 -c "import json; d=json.load(open('$HOME/.claude/.credentials.json')); print(d.get('claudeAiOauth', {}).get('accessToken', ''))" 2>/dev/null)
    if [ -n "$FRESH_TOKEN" ]; then
      ACCESS_TOKEN="$FRESH_TOKEN"
      # Update .tokens file for consistency

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The script prompts directly for an OAuth access token, meaning the skill is performing credential collection rather than delegating authentication to a trusted provider flow. In the context of a usage optimizer, this is more dangerous because users may be conditioned to paste high-value secrets into an untrusted local script for a convenience feature.

Content

Scanner excerpt · scripts/setup.sh (reported line 25)May include surrounding context.

sh

fi
fi

# Prompt for access token
echo "1️⃣  Enter your Access Token (sk-ant-oat01-...):"
read -r ACCESS_TOKEN

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api-endpoint.md:22