Claude Usage Analyzer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:55 AM UTC
• Version: 1.0.3

Overview

The skill is openly designed to analyze Claude Code usage, but it gives a third-party CLI broad access to all local Claude Code session logs, which can contain sensitive conversation and project data.

Install only if you are comfortable with the analyzer reading all matching Claude Code session logs for your account. Prefer using narrow date ranges or session-specific commands, avoid sharing JSON or per-turn output unless reviewed, and verify the external CLI source/version because the skill itself does not include or pin the implementation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:4

Finding

Broad Access to Sensitive Claude Code Session Logs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4-8, 14-18, and 24-31
Vulnerability Type: Sensitive Agent conversation-log access
Risk Level: Medium

The Skill grants an external CLI broad access to all Claude Code session logs matching the configured wildcard rather than limiting access to a user-selected project or session.

yaml

config_paths:
  - ~/.claude/projects/*/*.jsonl
requires:
  - claude-usage-analyzer

markdown

## Data access

- Reads `~/.claude/projects/*/*.jsonl` (local Claude Code session logs)
- Runs offline, no network access, no API keys, no credentials
- Open source: https://github.com/SingggggYee/claude-usage-analyzer

bash

claude-usage-analyzer

claude-usage-analyzer report --days 7
claude-usage-analyzer sessions
claude-usage-analyzer session <id>
claude-usage-analyzer --json

Technical Analysis

Claude Code JSONL session logs may contain sensitive prompts, responses, source-code fragments, filesystem paths, tool results, project details, and accidentally disclosed secrets. The wildcard path permits the required executable to process logs from every locally stored Claude project accessible to the current operating-system account.

The detailed per-session and per-turn commands can disclose substantially more information than aggregate usage statistics. The machine-readable JSON option also makes log-derived information easy to retain or pass to downstream tools.

The project contains no implementation of the required claude-usage-analyzer executable. Consequently, this audit cannot independently verify the documentation's claim that the executable operates offline and performs no network communication. There is no evidence in the reviewed Skill file that it collects credentials, exfiltrates data, escalates privileges, establishes persistence, or executes a remote payload.

Attack Path

1. A user asks the Agent to analyze token ...[truncated 1278 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user consent before reading any Claude Code session logs and clearly identify the projects, sessions, and date range that will be accessed.
2. Replace the global wildcard with least-privilege, user-selected paths. Default to one project, one session, or a narrowly bounded date range.
3. Default to aggregate token and cost statistics. Require separate confirmation before displaying prompts, responses, tool results, or per-turn details.
4. Redact secrets, source snippets, personal data, filesystem paths, and conversation content from reports, including JSON output.
5. Provide a dry-run or file-listing mode that shows which logs would be processed before access occurs.
6. Pin the required CLI to a reviewed version and verify its checksum or signature. Prefer vendoring auditable source when feasible.
7. Independently verify and enforce the stated offline behavior, such as by auditing the executable and restricting its network access during execution.
8. Avoid retaining generated reports by default and warn users that machine-readable output may contain sensitive log-derived data.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.