Is token-dashboard safe to install?

SaferSkills independently audited token-dashboard (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

Skills/token-dashboard/SKILL.md · 1 file

Skills/token-dashboard/SKILL.md2.1 KB · Markdown

name: token-dashboard

description: Open the Token Optimizer dashboard — collects session data, regenerates, and opens in browser.

Token Optimizer Dashboard

Opens an up-to-date dashboard showing your context usage trends, quality scores, session history, and skill management.

Instructions

Resolve runtime and measure.py path:

RUNTIME="${TOKEN_OPTIMIZER_RUNTIME:-}"
if [ -z "$RUNTIME" ]; then
  if [ -n "$CLAUDE_PLUGIN_ROOT" ] || [ -n "$CLAUDE_PLUGIN_DATA" ]; then
    RUNTIME="claude"
  elif [ -n "$CODEX_HOME" ] || [ -d "$HOME/.codex" ]; then
    RUNTIME="codex"
  else
    RUNTIME="claude"
  fi
fi

MEASURE_PY=""
for f in "$HOME/.codex/skills/token-optimizer/scripts/measure.py" \
         "$HOME/.codex/plugins/cache"/*/token-optimizer/*/skills/token-optimizer/scripts/measure.py \
         "$HOME/.claude/skills/token-optimizer/scripts/measure.py" \
         "$HOME/.claude/plugins/cache"/*/token-optimizer/*/skills/token-optimizer/scripts/measure.py; do
  [ -f "$f" ] && MEASURE_PY="$f" && break
done
[ -z "$MEASURE_PY" ] && { echo "[Error] measure.py not found. Is Token Optimizer installed?"; exit 1; }
export TOKEN_OPTIMIZER_RUNTIME="$RUNTIME"

Collect and open:

python3 "$MEASURE_PY" collect --quiet && python3 "$MEASURE_PY" dashboard

This collects the latest session data into the trends database, regenerates the dashboard HTML, and opens it in your default browser.

Tell the user the dashboard is open. URL-first ordering (v5.3.3+):

Probe daemon: python3 "$MEASURE_PY" daemon-status 2>/dev/null
If DAEMON_RUNNING: lead with URL: http://localhost:24842/token-optimizer (bookmarkable, auto-updates), then mention the file fallback.
For Claude Code file fallback: File: ~/.claude/_backups/token-optimizer/dashboard.html.
For Codex file fallback: File: ~/.codex/_backups/token-optimizer/dashboard.html.
If DAEMON_NOT_RUNNING in Claude Code: suggest python3 $MEASURE_PY setup-daemon (macOS and Windows).
If DAEMON_NOT_RUNNING in Codex: do not imply the Claude daemon is required; the generated file works, and Stop hooks refresh it when balanced hooks are installed.

token-dashboard— agent skill

Is token-dashboard safe to install?

Token Optimizer Dashboard

Instructions

Audit the pieces. Scan the whole. Decide.