octocode-stats — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited octocode-stats (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate a local HTML dashboard from Octocode usage stats. The build script owns all parsing, calculations, rendering, and browser-opening behavior; do not reimplement those calculations in chat or another script.
Use this skill when the user asks to:
stats.json or data under ~/.octocode/Do not use it for session ID lookup, credentials, or unrelated configuration files.
${OCTOCODE_HOME}/stats.json when OCTOCODE_HOME is set~/.octocode/stats.json otherwise--stats <path> when explicitly requestedNo stats yet — run any Octocode MCP tool first, then re-run this skill.
node skills/octocode-stats/scripts/build_dashboard.mjsCommon flags:
--stats <path>: read a non-default stats file--output <path>: write the dashboard somewhere else--no-open: generate without opening the browser--allow-empty: render an empty-state dashboard even when stats are missing--help: print script usageIf the browser did not open, include a manual open <dashboard-path> command on macOS.
estimatedTokensSaved = savedChars / 4. Always describe them as approximate.charsSavedByTool is cumulative response-savings data, not a recent activity log and not a complete per-tool call ledger.rawChars, responseChars, and savedChars are measurements from the response pipeline, not a perfect partition where raw = response + saved.responseChars is the final tool response after output pagination; rawChars counts upstream API/command/file payloads that were actually fetched or read.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.