Security audit
Security checks across malware telemetry and agentic risk
The skill is a local token-usage viewer, but its maintenance commands can persistently change PATH and recursively delete multiple install or skill directories without a clear confirmation step.
Review the setup/update/uninstall behavior before installing. Use the stats features only if you are comfortable with it reading local assistant usage files, and avoid running setup, update, or --uninstall unless you accept PATH changes and removal of the listed token-stats/agent-usage-stats directories.
"c.close();print(json.dumps({'rows':rows,'sc':sc},default=str))"
) % (linux_path, where, where)
try:
r = subprocess.run(
["wsl.exe", "-d", distro, "--", "python3", "-c", script],
stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, timeout=15,
)"c.close();print(json.dumps({'rows':rows,'sc':sc},default=str))"
) % (linux_path, where, where)
try:
r = subprocess.run(
["wsl.exe", "-d", distro, "--", "python3", "-c", script],
stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, timeout=15,
)65/65 vendors flagged this skill as clean.
No suspicious patterns detected.