token-tracker-daily

• Outcome: Pass
• Latest audit: May 29, 2026, 8:24 PM
• Version:
  1.0.0

Overview

This skill is a local token-usage logger and report generator with disclosed local storage and optional scheduling, but users should verify its paths before use.

Before installing, confirm where the Python files are installed and where token_log.json will be written. Run reports manually first, protect or delete the local usage log if token-usage metadata is sensitive, and add cron jobs only if you want recurring reports and know how to remove them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly documents reading and writing a local JSON file to persist token logs, but the metadata does not declare any permissions for those file operations. That creates a transparency and policy-enforcement gap: users or platforms may authorize the skill under the false assumption that it does not touch the filesystem, while it can still persist potentially sensitive usage telemetry.

VirusTotal

64/64 vendors flagged this skill as clean.