Toolkit for managing prompts, counting tokens, estimating costs, tracking usage, and viewing conversation history with OpenAI-compatible GPT models locally.
Security Analysis
high confidenceThe skill's description promises GPT integrations, token counting, cost estimates and model usage tracking, but the included script only logs inputs to a local data directory and does not perform the claimed operations.
The README/description claims managing prompts, token counting, cost estimation, conversation history and OpenAI-compatible model interaction. The provided script only echoes/prints inputs and appends them to files under ~/.local/share/gpt (or XDG_DATA_HOME). There is no token-counting logic, no cost estimation, no model/API calls, and no integration with OpenAI-compatible endpoints — so the implementation does not match the stated purpose.
SKILL.md instructs use of a CLI for GPT tasks, but the runtime instructions and shipped script are limited to simple local logging and user-facing messages. There are no instructions to read unrelated system files or environment secrets, which is good, but the docs imply broader capabilities that are not implemented.
There is no install spec and the skill is effectively instruction-only with a small shell script. Nothing is downloaded or installed automatically; risk from install mechanism is low.
No credentials or environment variables are required. The script respects XDG_DATA_HOME/$HOME for storage and optionally GPT_DIR as documented — this is proportional. Note: it will store user input under the data directory, which may contain sensitive content.
The skill does not request permanent/autonomous privileges (always:false). It only writes files to its own data directory and does not modify other skills or system settings.
Guidance
This skill is not malicious, but it is misleading: the description promises token counting, cost estimates and OpenAI model integration, but the shipped script only logs inputs to files and prints messages. Before installing or relying on it, inspect the script (already provided) and consider: it will save whatever you pass to ~/.local/share/gpt (or XDG_DATA_HOME/gpt), so do not feed sensitive prompts or API keys into it. If you need real token counting, cost estimation, or OpenAI API calls, use a verified tool or an implementation that explicitly includes those libraries (e.g., tiktoken, official SDKs) and requires the appropriate API key. If you still want this utility for simple local logging, run it in a safe environment and/or change GPT_DIR to a directory you control.
Latest Release
v1.0.2
Added feedback link
More by @xueyetianya
Published by @xueyetianya on ClawHub
