Token Stats Pkg

PassAudited by ClawScan on May 17, 2026.

Overview

This appears to be a local token-usage viewer, but it reads local AI assistant history files and creates a command wrapper, so users should be comfortable with that local access.

This skill looks coherent for local token monitoring. Before installing, be aware it reads local Hermes, Claude Code, CodeX, and OpenClaw usage/session files and can export statistics to a directory you choose. Avoid sharing exports unless you have reviewed them.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The tool can inspect local AI assistant history files, which may include sensitive session metadata or conversation-derived records even if the tool only displays token statistics.

Why it was flagged

The skill reads persisted local assistant data files, including recursive Claude Code project JSONL logs, to compute token statistics.

Skill content
数据来自本地 — 不联网,纯读你的 Agent 本地数据文件 ... Claude Code | `~/.claude/projects/**/*.jsonl`
Recommendation

Install only if you are comfortable allowing this tool to read those local assistant data paths; review exported JSON/CSV before sharing it.

What this means

A new token-stats command will remain available on the system until the user removes it.

Why it was flagged

Setup requires running the included Python script, which writes a persistent command wrapper under the user's local bin directory.

Skill content
Step 2: Create the global command (setup writes a shell wrapper, no +x needed)
python3 ~/skills/agent-usage-stats/token-stats.py setup
Recommendation

Run setup only from the installed skill directory you trust, and use the documented uninstall steps to remove ~/.local/bin/token-stats if no longer needed.