Track AI agent token usage, model costs, and budget thresholds with a TypeScript and SQLite workflow. Use when the user wants to instrument agent runs, calcu...
Security Analysis
high confidenceThe package code and SKILL.md are consistent with a local TypeScript + SQLite token usage tracker; it does not request credentials, network access, or unusual installs.
Name/description align with the code: CostCalculator, UsageTracker, and BudgetManager implement local token accounting, cost math, and budget enforcement. The dependency (better-sqlite3) is appropriate for the stated SQLite persistence.
SKILL.md instructions stay within scope: they explain instantiation, recording provider-returned usage metadata, budget evaluation, and reporting. No instructions ask the agent to read unrelated files, env vars, or send data to external endpoints.
There is no install spec (instruction-only), but the repository includes package.json and TypeScript sources which expect an npm build (better-sqlite3 native dependency). This is not malicious but means the user/host must run npm install/build locally to use the code.
The skill declares no required env vars, no credentials, and the code does not access environment variables or external services. It only writes/reads a local SQLite database (default path 'usage-tracker.db' unless overridden).
The skill does not request permanent platform presence (always is false) and does not modify other skills or system-wide configurations. It persists its own data to a local SQLite file as expected for this functionality.
Guidance
This appears to be a straightforward local usage-tracking library. If you plan to install or run it: (1) review and run the tests locally (the repo includes Vitest tests and examples); (2) note it writes a SQLite DB file (default 'usage-tracker.db') — avoid pointing it at directories containing sensitive data or credentials; (3) metadata fields are stored as JSON, so avoid sending sensitive PII into the metadata; (4) the dependency better-sqlite3 is a native module and may require build tools on your machine — inspect package.json and run npm install in a controlled environment; and (5) if you want remote reporting, verify and add explicit networking code rather than assuming the package will do it. Overall the package is coherent with its stated purpose.
Latest Release
v0.1.0
Initial release
More by @imgolye
Published by @imgolye on ClawHub
