Back to plugin

Security audit

Gateway

Security checks for vulnerabilities and agentic risk

Overview

The skill's code, instructions, and requirements are internally consistent with a local pre-call budget/guard plugin and do not request unrelated credentials or installs.

This plugin appears to do exactly what it says: locally estimate tokens/costs and block or downgrade requests. Before installing, consider: (1) Keep debug:false in production to avoid logging sensitive inputs; the redaction is shallow (only top-level keys), so nested secrets in logged objects could leak. (2) Provide accurate sessionSpentUsd from your accounting to avoid false allows/blocks. (3) Review the model pricing table and aliases to ensure they match your providers/prices. (4) Run the included tests and, if you plan to expose logs to shared systems, audit them to ensure nothing sensitive is emitted.

Static analysis

No suspicious patterns detected.