skills/cost-verification-auditor/SKILL.md
Audit LLM token cost estimates against actual API usage. Activate on 'cost verification', 'token estimate accuracy', 'API cost audit', 'estimation variance'. NOT for pricing lookups, budget planning, or cost optimization strategies.
npx skillsauth add curiositech/windags-skills cost-verification-auditorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Verify that token cost estimates are within ±20% of actual Claude API usage.
✅ Use for:
❌ NOT for:
Has estimator? ──No──→ Build estimator first (see Calibration Guidelines)
│
Yes
↓
Define 3+ test cases (simple/medium/complex)
↓
Estimate BEFORE execution (no peeking!)
↓
Execute against real API
↓
Calculate variance: (actual - estimated) / estimated
↓
Variance ≤ ±20%? ──Yes──→ PASS ✓
│
No
↓
Apply fixes from Anti-Patterns section
↓
Re-run verification
const inputVariance = (actual.inputTokens - estimate.inputTokens) / estimate.inputTokens;
const outputVariance = (actual.outputTokens - estimate.outputTokens) / estimate.outputTokens;
const costVariance = (actual.totalCost - estimate.totalCost) / estimate.totalCost;
// PASS if both input AND output within ±20%
const passed = Math.abs(inputVariance) <= 0.20 && Math.abs(outputVariance) <= 0.20;
Novice thinking: "Claude Code adds ~500 tokens overhead, so add that to every estimate."
Reality: Direct API calls have ~10 token overhead. The 500+ overhead is ONLY when using Claude Code's full context (system prompts, tools, conversation history).
Timeline:
What to use instead: | Context | Overhead | |---------|----------| | Direct API call | ~10 tokens | | With system prompt | 50-200 tokens | | With tools/functions | 100-500 tokens | | Claude Code full context | 500-2000 tokens |
How to detect: Consistent 40-90% overestimation = overhead too high.
Novice thinking: "Every node must be within ±20% or the estimator is broken."
Reality: LLM output length is non-deterministic. Per-node output variance of 30-50% is normal. What matters is aggregate cost accuracy.
What to use instead:
How to detect: Input estimates accurate, output varies wildly = normal LLM behavior.
Novice thinking: "Let me run the API call first to see what tokens we get, then build the estimator."
Reality: This produces perfectly-fitted estimates that fail on new prompts. Estimation must happen BEFORE execution.
Correct approach:
// Calibrated 2026-01-30
const inputTokens = Math.ceil(prompt.length / CHARS_PER_TOKEN) + OVERHEAD;
| Text Type | CHARS_PER_TOKEN | Notes | |-----------|-----------------|-------| | English prose | 4.0 | Most consistent | | Code | 3.0-3.5 | Symbols tokenize differently | | Mixed | 3.5 | Balanced (recommended default) | | JSON/structured | 3.0 | Punctuation heavy |
| Prompt Constraint | Multiplier | Notes | |-------------------|------------|-------| | "List exactly N items" | 0.8x input | Highly constrained | | "Brief summary" | 1.0x input | Moderate | | "Explain in detail" | 2-3x input | Expansive | | Unconstrained | 1.5x input | Variable |
Always: Minimum 100 output tokens for any meaningful response.
| Model | Output Tendency | |-------|-----------------| | Claude Opus | Longer, more detailed | | Claude Sonnet | Balanced | | Claude Haiku | Concise, efficient |
| Symptom | Cause | Fix | |---------|-------|-----| | Overestimating by 40%+ | Overhead too high | Reduce from 500 → 10 | | Underestimating inputs | Chars/token too high | Reduce from 4.0 → 3.5 | | Output wildly varies | LLM non-determinism | Use constrained prompts | | Total cost accurate but per-node off | Normal aggregation | Accept it, focus on totals |
(actual - estimated) / estimatedSee /references/calibration-data.md for detailed calibration tables and historical data.
data-ai
license: Apache-2.0 NOT for unrelated tasks outside this domain.
development
Use when designing caching strategies (cache-aside, write-through, write-behind), implementing distributed locks, building rate limiters, leaderboards, real-time streams (XADD/consumer groups), pub/sub, or tuning eviction policies. Triggers: thundering-herd on cache miss, dogpile on key expiry, Redlock vs SET-NX-PX choice, sliding-window rate limiter, hot-key on a single cluster slot, big-key blowup, MULTI/EXEC across slots, KEYS in production. NOT for Redis Cluster operations/admin (different domain), embedded KV (SQLite, leveldb), in-process LRU caches, or Memcached.
tools
Drawing the `'use client'` boundary correctly in React Server Components apps (Next.js App Router, RSC frameworks) — leaf-pushing, slot composition, serialization rules, and environment poisoning prevention. Grounded in react.dev and Next.js 16 docs.
development
Use when designing rate limiting for an API, choosing between token bucket / sliding window / leaky bucket / fixed window, implementing it in Redis, deciding edge (Cloudflare/Upstash) vs origin enforcement, sizing per-user vs per-IP vs per-endpoint quotas, returning the right 429 response with Retry-After, or fixing the boundary-burst bug in fixed-window limiters. Triggers: 429 too many requests, INCR + EXPIRE, ZADD + ZREMRANGEBYSCORE + ZCARD, X-RateLimit-Remaining header, Cloudflare WAF rate limiting rules, Upstash @upstash/ratelimit, leaky bucket shaping vs policing, distributed rate limiter consistency. NOT for DDoS mitigation specifically (different scale), CAPTCHA / bot management, full WAF design, or per-user quota billing.