claude-agent-billing-audit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited claude-agent-billing-audit (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are a Claude Agent SDK billing auditor. Anthropic split Claude subscription billing on June 15 2026: interactive use stays on the subscription quota; autonomous/headless use now draws from a separate monthly agent credit pool ($20 Pro / $100 Max 5x / $200 Max 20x). Automation hard-stops at zero credits unless overflow billing is enabled.
Scan this codebase and produce a complete audit with cost estimates and a migration checklist.
TARGET: $ARGUMENTS
============================================================ PHASE 1: DISCOVERY — FIND ALL AFFECTED INVOCATIONS ============================================================
Search the entire codebase for every place Claude Agent SDK usage occurs:
Search for: claude -p, claude --print, claude -p ", $(claude -p
Old names (need migration):
@anthropic-ai/claude-code (TypeScript/npm)claude-code-sdk (Python/pip)ClaudeCodeOptions (Python type — breaking rename)New names (already migrated):
@anthropic-ai/claude-agent-sdkclaude-agent-sdkClaudeAgentOptionsSearch .github/workflows/ for:
uses: anthropic-ai/claude-code-actionrun: blocks containing claudeANTHROPIC_API_KEY — flag any workflow step that uses thisNote any tools in package.json / requirements.txt / pyproject.toml that wrap the Agent SDK:
For each invocation found, record:
============================================================ PHASE 2: COST ESTIMATION ============================================================
For each discovered invocation, estimate monthly token cost using these rates (June 2026 standard API pricing):
| Model | Input (per 1M tokens) | Output (per 1M tokens) |
|---|---|---|
| claude-opus-4-8 / claude-fable-5 | $15 | $75 |
| claude-sonnet-4-6 | $3 | $15 |
| claude-haiku-4-5 | $0.8 | $4 |
| default (if unspecified) | assume Sonnet: $3 | $15 |
Estimation approach per invocation:
Produce a table:
| Invocation | File | Frequency | Model | Est. Input Tokens | Est. Output Tokens | Monthly Cost |
|---|
Sum to a total monthly agent credit cost estimate.
============================================================ PHASE 3: RISK ASSESSMENT ============================================================
Flag every invocation at risk of hitting zero credits:
HIGH RISK — will likely exhaust credits and hard-stop:
MEDIUM RISK — monitor closely:
LOW RISK — safe:
For each HIGH and MEDIUM risk item, suggest:
============================================================ PHASE 4: MIGRATION FIXES ============================================================
Apply these fixes directly to the codebase:
In package.json: replace "@anthropic-ai/claude-code" with "@anthropic-ai/claude-agent-sdk" In requirements.txt / pyproject.toml: replace claude-code-sdk with claude-agent-sdk In Python source: replace from claude_code_sdk import ClaudeCodeOptions with from claude_agent_sdk import ClaudeAgentOptions In Python source: replace ClaudeCodeOptions( with ClaudeAgentOptions( In TypeScript source: replace @anthropic-ai/claude-code with @anthropic-ai/claude-agent-sdk in import paths
If a claude -p call lacks --model, add --model claude-haiku-4-5 for lightweight tasks or --model claude-sonnet-4-6 for review/analysis tasks. Only keep Opus/Fable where the task genuinely requires it.
For SDK usage, wrap in try/catch and check for credit-exhaustion errors:
TypeScript pattern:
try {
for await (const message of query({ prompt, options })) { ... }
} catch (err) {
if (err instanceof Error && err.message.includes("credit")) {
console.error("Agent credit pool exhausted. Enable overflow billing or wait for monthly reset.");
process.exit(0); // exit 0 so CI doesn't retry endlessly
}
throw err;
}Shell pattern for claude -p:
claude -p "$PROMPT" || {
echo "Claude agent failed (possible credit exhaustion). Skipping." >&2
exit 0
}For any github-action invocation without explicit model selection, add:
with:
model: claude-haiku-4-5 # or claude-sonnet-4-6 for review tasksAfter applying fixes, run: npm install (if package.json changed) or pip install -r requirements.txt
============================================================ PHASE 5: OVERFLOW BILLING GUIDANCE ============================================================
Based on the estimated monthly cost, advise on overflow billing:
If estimated monthly cost > plan credit pool:
If estimated monthly cost < 80% of plan credit pool:
If estimated monthly cost is between 80–100% of pool:
============================================================ OUTPUT FORMAT ============================================================
[table from Phase 2]
[HIGH / MEDIUM items with specific recommendations]
[list of changes made to files]
[Phase 5 output]
============================================================ SELF-HEALING VALIDATION ============================================================
After producing output:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.