caveman-evidence-review
An agent skill by JuliusBrussee, from JuliusBrussee/caveman. Tags: analytics, cost-optimization, observability, review.
What it does
Read-only review of Caveman Cloud evidence: cost, Cave Score, workflows, traces, latency, errors, routing, savings. Use when asked what Caveman found or where LLM spend goes.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add JuliusBrussee/caveman --skill caveman-evidence-reviewOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/JuliusBrussee/caveman
cp -r caveman/skills/caveman-evidence-review ~/.claude/skills/caveman-evidence-reviewSafety box score
Grade B, low risk: 19 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a read-only Caveman Cloud reviewer: it queries project context, costs, scores, workflows, traces, and savings, with a CLI fallback if MCP is unavailable. The main risks are remote data access over the network and the need to execute the local `caveman` CLI against an authenticated account; it is explicitly designed not to start or change experiments.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It can invoke local shell commands as a fallback, e.g. `caveman cloud whoami`, `caveman cloud costs`, and `caveman cloud traces search ...`; this is limited to read-only operations but still executes a local binary. |
| Network access | 2 (moderate) | The skill reads Caveman Cloud/MCP data (`caveman_context {}`, `caveman_report`, `caveman_trace_search`), so project metadata and traces leave the machine to a remote service. |
| Filesystem reach | 0 (none) | The instructions do not read, write, or delete local files outside the project; the scope is cloud data and CLI output only. |
| Secrets & credentials | 1 (low) | It may rely on an authenticated Caveman session and tells the user to run `caveman login` if login or project selection is missing, but it does not ask for raw secrets or keys. |
| Privilege & persistence | 0 (none) | No sudo, global installs, services, shell profile edits, or OS setting changes are requested. |
| Instruction hijack surface | 0 (none) | The skill does not tell the agent to ignore its rules or follow external instructions; instead it emphasizes read-only behavior and bounded reads. |
| Irreversible actions | 0 (none) | It explicitly forbids state-changing actions: `Never start, approve, cancel, or roll back an experiment from this skill.` |
| Transparency | 0 (none) | The skill text is plain markdown with no binaries, encoded blobs, downloaded installers, or hidden runtime-decoded code. |
Before installing
- Confirm the `caveman` CLI is trusted and installed from a source you expect, since the skill may run it as a fallback.
- Use a least-privilege Caveman account and verify the selected project is the intended one before any review.
- If you may need raw prompts/completions/tool payloads, confirm that explicitly before using this skill, because payload retrieval is off by default.
Rated 2026-10-16 by an automated review of 1 file from the skill's repository.
Source
- Repository
- JuliusBrussee/caveman (all skills from this repository)
- Path
- skills/caveman-evidence-review/SKILL.md
- Branch
- main
- Updated
- 2026-10-05
Related skills
- agents-optimize — Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI/CD quality gates, observability, or cost optimization.
- aws-billing-and-cost-management — Analyze AWS costs, find savings, manage budgets, evaluate Savings Plans and Reserved Instances, right-size EC2/Lambda/RDS/EBS with Compute Optimizer.
- caveman-learn — Act on a Caveman learn report - review the ranked token sinks, apply cost-lowering fixes with per-edit consent, and report what those fixes returned.
- claude-usage-analyst — Analyze Claude Code and Claude Desktop Code token usage, cost, quota burn, model mix, cache read/write, and 5-hour block consumption using ccusage evidence.
- gstack-openclaw-retro — Weekly engineering retrospective. Analyzes commit history, work patterns, and code quality metrics with persistent history and trend tracking.
- retro — Weekly engineering retrospective. (gstack)