Install
$ agentstack add skill-zrozoom-agent-skills-core-cost-check ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Cost Check Skill
Report infrastructure cost, plan, quota, and expiry risks.
Contract
- Inputs: optional domain list or service filter.
- Output: a Polish cost and expiry report with alerts.
- Side effects: none. Do not change billing plans, renew domains, rotate secrets, or cancel services.
Known Services
> Configure for your project. Maintain the list of services below in .claude/memory/reference_.md (or equivalent) and reference it from here.
| Service | Identifier | |---|---| | Hosting (e.g. Netlify/Vercel) primary | `, site ID | | Hosting secondary (if any) | , site ID | | Database (e.g. Supabase/Postgres) | project ref / connection string | | Domains | , `, plus any domains in hosting |
Workflow
1. Check Netlify
Use Netlify MCP when available:
- project/service lookup for both known sites
- latest deploy status
- plan/team information if exposed
- domain list and SSL status
If MCP is unavailable, use Netlify CLI/API only if already authenticated. Do not request or print tokens.
2. Check Supabase
test -f supabase/.temp/project-ref && cat supabase/.temp/project-ref
if command -v supabase >/dev/null 2>&1; then
supabase projects list
else
npx supabase projects list
fi
If Supabase CLI is not authenticated, report that billing/quota status was not checked.
3. Check domains and SSL
Use the safest available command:
openssl s_client -servername -connect :443 /dev/null | openssl x509 -noout -dates
openssl s_client -servername -connect :443 /dev/null | openssl x509 -noout -dates
For registrar expiry, use whois if available:
whois
whois
If WHOIS is unavailable or redacted, say so and rely on Netlify/registrar data supplied by the user.
4. Check API cost risks
Look for AI/API usage points:
rg -n "OPENAI|ANTHROPIC|GEMINI|GOOGLE|AI_GATEWAY|generate-quiz|chat-with-ai|rate-limit" supabase src netlify .env.example
Report whether rate limiting exists before expensive calls. Look for guards such as rate-limit, throttle, quota, or model-strategy in your backend / serverless functions / API routes.
5. Output
## Cost check
**Checked at:** YYYY-MM-DD HH:mm Europe/Warsaw
**Verdict:** ok / watch / action needed
### Alerts
| Severity | Service | Finding | Action |
|---|---|---|---|
### Netlify
- Primary: ...
- Secondary: ...
### Supabase
- Project: ...
- Plan/quota: checked / unavailable
### Domains and SSL
| Domain | DNS/SSL | Registrar expiry | Notes |
|---|---|---|---|
### API cost risk
- ...
Rules
- Never paste secrets, auth tokens, API keys, or billing card details.
- Never change paid plans automatically.
- Treat expiry within 30 days as
action needed; within 60 days aswatch. - If a source cannot be checked, report it as unknown rather than guessing.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: ZroZoom
- Source: ZroZoom/agent-skills-core
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.