Skip to content
Back to skills

Token Efficiency Audit

ASecurity

Three-layer token defense stack — audit current settings, apply safe/CI levers, and monitor status

  • 43 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 9, 2026
devopsgobashrailsgit

Works with

  • claude code
  • cli
  • mcp

Security analysis

A100/100

Scanned September 9, 2026

npx -y skills add baekenough/oh-my-customcode --skill token-efficiency-audit --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Token Efficiency Audit?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Token Efficiency Audit
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/baekenough-token-efficiency-audit/badge)](https://www.skillsdirectory.com/skills/baekenough-token-efficiency-audit)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: token-efficiency-audit
description: Three-layer token defense stack — audit current settings, apply safe/CI levers, and monitor status
scope: package
user-invocable: true
argument-hint: "[audit|apply-interactive|apply-ci|status]"
version: 1.0.0
---

# Token Efficiency Audit Skill

Layer 3 of the three-layer token defense stack. Audits current Claude Code settings against the token efficiency lever reference table, applies safe interactive levers, and reports combined layer status.

Reference guide: `guides/claude-code/14-token-efficiency.md`

## Three-Layer Stack

```
┌─────────────────────────────────────────────────────────────────┐
│  Layer 1: cc-token-saver (CACHE DEFENSE)                        │
│  Before session — protect prompt cache TTL from idle expiry     │
├─────────────────────────────────────────────────────────────────┤
│  Layer 2: R013 Ecomode (RUNTIME COMPRESSION)                    │
│  During session — compact output, aggregate results, prune input│
├─────────────────────────────────────────────────────────────────┤
│  Layer 3: token-efficiency-audit (PRE-SESSION PREVENTION)       │
│  Config time — disable injections before they happen            │
└─────────────────────────────────────────────────────────────────┘
```

Each layer is independently deployable and non-overlapping. Layer 3 (this skill) operates at config time — it prevents overhead from ever entering the context window.

## Modes

### audit (default)

1. Read `.claude/settings.json` (project-level, git-tracked)
2. Read `.claude/settings.local.json` (local, not git-tracked)
3. Check each lever from the Interactive Session Levers table in the guide:
   - `includeGitInstructions`
   - `autoConnectIde`
   - `attribution.commit`
   - `attribution.pr`
   - `env.BASH_MAX_OUTPUT_LENGTH`
   - `env.CLAUDE_CODE_FILE_READ_MAX_OUTPUT_TOKENS`
   - `env.MAX_MCP_OUTPUT_TOKENS`
4. Output a table:

```
[Token Efficiency Audit]
Reference: guides/claude-code/14-token-efficiency.md (CC v2.1.114+)

| Lever                               | Current     | Recommended | Gap    | Location              |
|-------------------------------------|-------------|-------------|--------|-----------------------|
| includeGitInstructions              | true        | false       | ⚠ SET  | settings.json         |
| autoConnectIde                      | true        | false       | ⚠ SET  | settings.json         |
| attribution.commit                  | auto text   | ""          | ⚠ SET  | settings.json         |
| attribution.pr                      | auto text   | ""          | ⚠ SET  | settings.json         |
| BASH_MAX_OUTPUT_LENGTH              | unlimited   | 15000       | ⚠ SET  | settings.local.json   |
| CLAUDE_CODE_FILE_READ_MAX_OUTPUT... | unlimited   | 8000        | ⚠ SET  | settings.local.json   |
| MAX_MCP_OUTPUT_TOKENS               | unlimited   | 8000        | ⚠ SET  | settings.local.json   |

Run /token-efficiency-audit apply-interactive to apply all safe levers.
```

Gap column values:
- `OK` — already at recommended value
- `⚠ SET` — currently at default, recommended change available
- `CUSTOM` — non-default value that differs from recommendation (display actual value)

### apply-interactive

Applies Interactive Session Levers only (safe for development use).

1. Read `.claude/settings.json` and `.claude/settings.local.json` (create if not exists)
2. Apply to `settings.json`:
   ```json
   {
     "includeGitInstructions": false,
     "autoConnectIde": false,
     "attribution": {
       "commit": "",
       "pr": ""
     }
   }
   ```
3. Apply to `settings.local.json` (env block):
   ```json
   {
     "env": {
       "BASH_MAX_OUTPUT_LENGTH": "15000",
       "CLAUDE_CODE_FILE_READ_MAX_OUTPUT_TOKENS": "8000",
       "MAX_MCP_OUTPUT_TOKENS": "8000"
     }
   }
   ```
4. Preserve all existing settings (merge, do not overwrite unrelated keys)
5. Report applied changes:
   ```
   [Done] Interactive levers applied

   settings.json:
     includeGitInstructions: true → false
     autoConnectIde: true → false
     attribution.commit: (auto) → ""
     attribution.pr: (auto) → ""

   settings.local.json:
     BASH_MAX_OUTPUT_LENGTH: (none) → 15000
     CLAUDE_CODE_FILE_READ_MAX_OUTPUT_TOKENS: (none) → 8000
     MAX_MCP_OUTPUT_TOKENS: (none) → 8000

   Note: settings.json is git-tracked. Commit if appropriate.
   Takes effect on next claude session restart.
   ```

### apply-ci

Applies CI/Worker-Only Levers. These disable core oh-my-customcode functionality.

**R001 Risk: HIGH** — Display this warning prominently BEFORE applying:

```
⚠ WARNING — CI/WORKER LEVERS

These settings disable core oh-my-customcode functionality:
  • CLAUDE_CODE_DISABLE_CLAUDE_MDS=1  → ALL rules and routing offline (R010 disabled)
  • CLAUDE_AGENT_SDK_DISABLE_BUILTIN_AGENTS=1 → All 50 agents unavailable
  • ENABLE_CLAUDEAI_MCP_SERVERS=false → MCP-dependent skills unavailable
  • CLAUDE_CODE_DISABLE_AUTO_MEMORY=1 → No persistent memory across sessions

Only use for CI/worker pipelines. Never apply to interactive development sessions.

Type "yes" to confirm, or anything else to cancel:
```

1. Require explicit user confirmation ("yes") before proceeding
2. On confirmation, apply to `settings.local.json`:
   ```json
   {
     "env": {
       "CLAUDE_CODE_DISABLE_CLAUDE_MDS": "1",
       "CLAUDE_AGENT_SDK_DISABLE_BUILTIN_AGENTS": "1",
       "ENABLE_CLAUDEAI_MCP_SERVERS": "false",
       "CLAUDE_CODE_DISABLE_AUTO_MEMORY": "1"
     }
   }
   ```
3. Report:
   ```
   [Done] CI/Worker levers applied to settings.local.json

   This file is NOT git-tracked.
   To undo: remove the four env keys or run /token-efficiency-audit status
   ```
4. On cancellation: `[Cancelled] No changes made.`

### status

Reports current state of all three layers.

1. Check Layer 1 — cc-token-saver:
   - Check if plugin is present (look for cc-token-saver in `.claude/` plugin config or known plugin markers)
   - Report: Installed / Not installed
2. Check Layer 2 — R013 Ecomode:
   - Read `.claude/settings.json` for ecomode config
   - Report: threshold, result_format, max_result_length if set; otherwise "auto-threshold (4 tasks)"
3. Check Layer 3 — Settings levers:
   - Run the same lever checks as `audit` mode
   - Summarize: N/7 levers at recommended values
4. Check OTel availability:
   - Look for `CLAUDE_CODE_ENABLE_TELEMETRY` in settings
   - If present: report "OTel enabled — use /monitoring-setup status for metrics"
5. Output:

```
[Token Efficiency Status]

Layer 1: cc-token-saver    ✓ Installed / ✗ Not installed
Layer 2: R013 Ecomode      ✓ Active (threshold: 4) / ✗ Not configured
Layer 3: Settings levers   4/7 at recommended

Layer 3 details:
  includeGitInstructions: false ✓
  autoConnectIde: true ⚠
  attribution.commit: "" ✓
  attribution.pr: "" ✓
  BASH_MAX_OUTPUT_LENGTH: 15000 ✓
  CLAUDE_CODE_FILE_READ_MAX_OUTPUT_TOKENS: unlimited ⚠
  MAX_MCP_OUTPUT_TOKENS: unlimited ⚠

Run /token-efficiency-audit apply-interactive to fix ⚠ levers.
OTel: not enabled — run /monitoring-setup enable to measure effectiveness.
```

## Codex Levers

When Codex CLI is in use (detected by presence of `~/.codex/config.toml`):

Recommended settings in `config.toml`:
```toml
[features]
apps = false

[apps._default]
enabled = false

web_search = "disabled"

tool_output_token_limit = 10000
```

Non-interactive Codex CLI flag reference: `guides/claude-code/13-cli-flags.md`

## Guardrails

### The Re-Call Trap

Setting output limits too low forces repeated re-call loops — the model issues `tail -n 50 output.txt` or re-reads files in chunks, costing more tokens than the original uncapped output.

**Enforce these minimum floors (never go below):**

| Variable | Safe minimum | Recommended |
|----------|-------------|-------------|
| `BASH_MAX_OUTPUT_LENGTH` | 10000 | 15000 |
| `CLAUDE_CODE_FILE_READ_MAX_OUTPUT_TOKENS` | 4000 | 8000 |
| `MAX_MCP_OUTPUT_TOKENS` | 4000 | 8000 |
| Codex `tool_output_token_limit` | 5000 | 10000 |

If a user requests values below these floors, warn them of the re-call trap risk before applying.

### Version Drift

Settings defaults change with minor CC version releases. After each upgrade, re-run `/token-efficiency-audit audit` to verify active defaults. Reference baseline: CC v2.1.114+ / Codex v0.121.0+.

## Cross-References

- `guides/claude-code/14-token-efficiency.md` — Full three-layer stack guide and lever table
- `.claude/rules/SHOULD-ecomode.md` (R013) — Layer 2 specification
- `.claude/skills/monitoring-setup/SKILL.md` — Measure effectiveness via OTel metrics
- `guides/cc-token-saver/README.md` — Layer 1 detailed guide
- `guides/claude-code/13-cli-flags.md` — Non-interactive/CI CLI flags

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…