Viral Claude Code usage-audit skill reads local logs to answer questions about your activity: why it is not safe to use

What happened

On August 13, 2026, a Reddit user shared a Claude Code skill that reads local usage logs and lets Claude answer questions about your activity. The post says the author found 1,555 sessions in one day and 1.22 billion tokens in one week from a background coding agent. Tokens are small chunks of text that AI systems count for usage and billing.

The stated goal was to debug unexpected costs. But a skill that reads detailed local logs may also pull in sensitive information such as prompts, project names, file paths, or signs of account activity.

What it means for you

If you use Claude Code, Codex, or similar AI agents, a log-reading skill can reveal more than usage totals. Local logs often contain a record of what you asked, what project you worked on, and where files live on your computer.

For a normal user, the safest assumption is simple: if a skill can read logs, it may reveal private work history unless you confirm exactly which files it accesses and where any results are sent.

What to do instead

Before installing a skill, check what folders and files it reads. If that is not clear, do not install it.

Do not share logs or audit outputs publicly unless you have removed prompts, names, paths, and other identifying details.

If you only need cost checks, prefer built-in usage tools or a simpler script that reports totals without sending full log contents to an AI.

If you want third-party skills, AgentPod lists only reviewed, tested skills, but you should still verify permissions and data flow for your own setup.

Sources:

• https://www.reddit.com/r/ClaudeAI/comments/1vn6tj5/my_claude_max_limits_kept_running_out_and_i/