cost-session — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cost-session (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When cost-anomaly flags a session as a >3.5σ outlier, the next question is "which MESSAGES were expensive?". cost-session answers that.
| Question | Skill |
|---|---|
| "Which sessions cost the most?" | cost-conversation |
| "Which sessions are outliers?" | cost-anomaly |
| "Which messages in THIS session were expensive?" | `cost-session` ← this |
Implementation: scripts/session.mjs.
--session-id <id> (scans ~/.claude/projects/*/)or --latest (default; picks most-recently-modified jsonl).
usage blocks._prices.mjs).cost_usd, surface top-N (default 20).Example real session, top message:
| # | Model | In | Out | Cache W | Cache R | Cost |
| 1 | opus-4-7 | 6 | 569 | 881898 | 0 | $16.58 |Without the Cache W column it looks like "569 output tokens cost $16" — that's wrong by 380×. The actual cost is ephemeral 1h cache write at opus pricing: 881,898 tokens × $18.75/1M = $16.54.
Operators reading the table see immediately: "the model wrote 881K tokens to ephemeral cache". From there the question becomes "why did we cache 881K tokens of context for a 6-input request?" — that's a real engineering signal.
# Step 1: find outliers across all sessions
cost anomaly --alert-on-outliers 1 || cost anomaly # see which session-ids
# Step 2: drill into the flagged session
cost session --session-id <flagged-id> --top 10
# Step 3: open that jsonl at the timestamp the top message reports,
# inspect the prompt + tool callsTop of output:
| p50 (median) message | $0.85 |
| p90 message | $1.45 |
| p99 message | $1.74 |Lets operators ask "is this top message a 2× outlier or a 380× one?" without having to compute it themselves. The "top is >2× p99" footer fires when the answer is "yes, this is an in-session outlier worth investigating".
Useful for drilling into a specific time range within a long session:
cost session --since 2026-06-16T13:00:00Z --top 5Only messages with timestamp >= --since are considered.
--session-id not found in any project's jsonls → exit 2 with error.--top must be a positive integer → exit 2.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.