Tokencount

Text and token counter for AI and NLP. Count words, characters, sentences, paragraphs, and estimate GPT tokens. Analyze text complexity and readability scores.

Security Scan

The packaged script and runtime instructions do not match the skill's stated purpose: the SKILL.md promises a token/word counter but the included script is a crypto/toolkit-style CLI that reads and writes persistent logs and exposes many unrelated commands.

Purpose & Capability

Name/description advertise a text/token counter. The included scripts and help text implement a 'crypto toolkit' (commands: portfolio, price, whale-watch, gas, track, etc.) — functionality unrelated to counting text or estimating GPT tokens. SKILL.md also claims 'pure bash with embedded Python' while the provided code is a large bash script with no embedded Python visible. This is a clear mismatch.

Instruction Scope

SKILL.md gives only basic usage (run 'tokencount help') and notes a data directory env var. The script, however, reads/writes many log files under ~/.local/share/tokencount (or DATA_DIR), records user-supplied inputs to persistent logs (history.log, track.log, portfolio.log, etc.), and exposes search/export/status features. Persisting arbitrary user input to disk is beyond what a simple token counter would need and could accidentally store sensitive text. The SKILL.md does not disclose the full file I/O behavior or the many crypto-related commands.

Install Mechanism

No install spec (instruction-only), which is lower risk in isolation. However, the skill includes an executable script file that will be present in the skill bundle; there are no external downloads. Because code is bundled, the agent may write/execute it locally — inspect the full script before running.

Credentials

Declared requirements list no environment variables or credentials, but SKILL.md references TOKENCOUNT_DIR and the script unconditionally writes to $HOME/.local/share/tokencount. The number and type of persistent log files and crypto-focused commands suggest behavior that would normally require external APIs/keys (e.g., price/whale-watch) — yet no API credentials are requested or explained, which is inconsistent and suspicious.

Persistence & Privilege

The skill does not request elevated platform privileges or 'always: true'. It does persist data under the user's home directory (~/.local/share/tokencount), which is normal for a CLI but notable because the skill's stated purpose doesn't justify persistent logs and many unrelated features.

What to consider before installing

Do not install or run this skill without further review. The description promises a token/word counter but the bundled script implements a crypto/portfolio toolkit and writes many persistent logs under your home directory. Before proceeding: 1) Inspect the entire scripts/script.sh for network calls (curl/wget/ssh) or telemetry that could exfiltrate data. 2) Verify why crypto-related commands are present and whether they contact external APIs or require credentials. 3) If you only need a token counter, prefer a simpler, transparent implementation or a vetted tool. 4) If you test it, run in a sandbox or disposable account and avoid supplying any sensitive text or credentials.

Text and token counter for AI and NLP. Count words, characters, sentences, paragraphs, and estimate GPT tokens. Analyze text complexity and readability scores.

Quick Start

Run tokencount help for available commands and usage examples.

Features

• Fast and lightweight — pure bash with embedded Python
• No external dependencies required in ~/.tokencount/
• Works on Linux and macOS

Usage

tokencount help

---

💬 Feedback: https://bytesagain.com/feedback Powered by BytesAgain | bytesagain.com

When to Use

• as part of a larger automation pipeline
• when you need quick tokencount from the command line

Output

Returns reports to stdout. Redirect to a file with tokencount run > output.txt.

Configuration

Set TOKENCOUNT_DIR environment variable to change the data directory. Default: ~/.local/share/tokencount/