agentsclimarketplace

Report smoke

Skill zapgun-ai/clawback/.skills/report_smoke

Tokenmaxxing Gateway for Claude Code

Install
npx -y skills add zapgun-ai/clawback --skill report_smoke

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

End-to-end smoke test for the /<admin-path>/report saved-run viewer. Boots the real clawback binary against the repo's runs/ dir and curls every report route, asserting status + content, prefix mutability, public-read exemption, and that sensitive run-dir siblings stay unreachable. Use after touching src/report.js, src/report_ui/*, or the admin/report wiring.

SKILL.md

2.6 KB, as published. Nobody here has run it

clawback report viewer smoke test

Run .skills/report_smoke/scripts/report_smoke.sh from the project root:

.skills/report_smoke/scripts/report_smoke.sh

Environment variables (optional):

  • CLAWBACK_REPORT_DIR — runs directory to serve (default ./runs)

It needs at least one completed run on disk (a subdir with a parseable summary.json). The repo ships runs/smoke and runs/L0-tier1; the L0-tier1 run also contains the sensitive proxy.*.log + turns.*.ndjson siblings, which is exactly what the non-exposure assertions check against.

No upstream and no API key are required — report routes never proxy to Anthropic. The proxy boots over plain HTTP on a free high port and is torn down on exit. Exit code is the number of failed assertions (0 = all green).

What the script verifies:

  1. Static + base injection — /_proxy/report/ serves index.html with __BASE__ replaced by the real /_proxy/report/ base href (no literal __BASE__ leaks); report.js/report.css serve with correct MIME types.
  2. Dynamic routes against real analyzer output — /runs lists the on-disk runs newest-first; /data?run=L0-tier1 returns summary (carrying the tokens reclaim block) + charts + csvBytes; /chart/<id>/tokens_saved.svg serves that SVG by name (the same route also serves the bare tokens_saved.bg.svg share-card background); /csv/<id> serves a CSV download.
  3. Security (allowlist is the control; traversal guards are depth) — the proxy.*.log / turns.*.ndjson siblings are unreachable, the data payload does not leak their bytes, and ?run=.. / encoded traversal are rejected 400.
  4. Publicly readable — a GET with a bogus Host 421s on a guarded endpoint (/_proxy/metrics) but the report viewer is exempt and still returns 200.
  5. Dashboard cross-link — /_proxy/ui/ exposes the reportLink.
  6. Prefix mutability — a re-boot with --admin-path ctrl serves /ctrl/report/... (base href injected as /ctrl/report/) while the old /_proxy/report/ path 404s, proving the admin prefix is not hardcoded.

Complements test/report.test.js (unit-level, synthetic run dirs): this exercises the shipped bin/clawback.js boot path against real runs.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.