Is why safe to install?

SaferSkills independently audited why (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/why/SKILL.md · 1 file

skills/why/SKILL.md1.4 KB · Markdown

description: Forensic audit of the user's most recent Claude Code session. Returns total spend, output ratio, duplicate file reads, idle context after auto-compact, top expensive tool calls, and an estimate of what Sipcode would have RECOVERED if optimizers were active. Use when the user asks "where did my tokens go?", "audit my last session", "why was that session so expensive?", or any forensic question about a past Claude Code session.

Sipcode — Why (session forensics)

Call the sipcode:audit_latest_session MCP tool to produce a forensic report of the user's most recent Claude Code session.

If the user provides a session ID prefix (e.g., "audit session 3bca35e2"), pass it as the session_id argument. Otherwise, omit and the tool will pick the most recent session across all projects.

When presenting the result:

Lead with the output ratio (the percentage of total tokens that were actual code output). 0.3–2% is typical.
Surface the top 3 leaks with their dollar cost.
The "Sipcode estimates ~X tokens were RECOVERABLE" line is potential, not realized. Only realized after sipcode rules --install + new sessions + sipcode impact. Be explicit about this when relaying the number.
If the session is unusually large (> $10) or unusually wasteful (output ratio < 0.2%), call that out.

Do NOT extrapolate the single-session savings across many sessions. Each session is its own forensic snapshot.

why— agent skill

Is why safe to install?

Sipcode — Why (session forensics)

Audit the pieces. Scan the whole. Decide.