Is AviVAvi/TokenScope safe?

SKILL.md Step 2 explicitly instructs the agent to read session JSONL transcripts from ~/.claude/projects//*.jsonl to gather workflow context. These files contain the complete conversation history for every Claude Code session. Users routinely paste API keys, passwords, private source code, and other secrets into Claude conversations. By loading these transcripts into the agent context during a token audit, the skill exposes all previously typed sensitive material to the running AI model. The parser.ts module reads all message types including user messages, assistant responses, and tool call inputs/outputs.

The auditd records show all six major credential files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud application_default_credentials.json) being opened and read at timestamp 1784830454.235, which occurs after all file analysis is complete. The first access at 1784830432 is attributable to the audit framework placing its honeypot canaries. The second access sequence — hitting all six credential files in rapid succession at the end — is unexplained and cannot be attributed to any identified process in the analysis pipeline.

The SKILL.md contains a hardcoded absolute path to the developer's personal Windows machine: 'C:\Users\Asmit\OneDrive\bohra-labs\token-cost-mcp'. This path is meaningless on any other machine and forces a Glob fallback search. While not malicious, it demonstrates the skill was shipped without proper testing on any machine other than the author's, indicating poor quality control and operational security hygiene.

The mcp.ts module reads ~/.claude.json, which contains the user's complete Claude configuration including all globally enabled MCP servers, per-project MCP server configurations, and project path mappings. This data is used for the MCP audit feature, but it exposes all of the user's tool integration configuration to the skill's analysis context.

The recommend.ts buildRecommendations function reads actual files from the user's filesystem. It collects file paths that appeared frequently in conversation transcripts (hot files) and then reads those files from disk to measure their line count. This means the skill can access any file the user previously worked on during a Claude session, including source code, configuration files, documentation, and data files.

The codemap subcommand (codemap.ts) generates and writes CODEMAP.md to any directory the user or agent specifies, defaulting to the current working directory. This is a documented feature but means the skill can create or overwrite files in user project directories when the codemap command is invoked.

The git clone connected only to GitHub (140.82.121.4:443). No unexpected external hosts were contacted, no firewall-blocked connection attempts occurred, no unexpected processes were spawned, and all filesystem writes were confined to the clone directory.