CostSAFE

Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops, exploit chain builder.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: cost
description: "Show cost tracking and ROI for this engagement."
disable-model-invocation: false
---
Show engagement cost data.

Run these in sequence:
1. `uv run python3 $CLAUDE_PROJECT_DIR/tools/cost.py summary`
2. `uv run python3 $CLAUDE_PROJECT_DIR/tools/cost.py roi`
3. Provide analysis: which agents consumed the most, whether the spend is justified by findings.

## Top-Tier ROI Review

Cost review is a hunting control, not accounting trivia.

- Segment spend by phase: recon, ranking, hunting, validation, reporting, rework.
- Flag any agent class with high spend and low durable output: no new surface, no killed hypotheses, no confirmed evidence.
- Compare spend to expected value: bounty range, report probability, duplicate risk, and remaining proof work.
- Recommend one concrete budget move: continue, pivot class, reduce parallelism, raise min-score, skip noisy targets, or run a focused chain pass.
- Treat repeated false positives as a training signal. Link the spend spike to `/learn`, `/brain`, or rules updates.

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (1)

Gates applied: no_behavioural_pass, no_license.