October 20, 2026 · Claude Code · 5 min read

Which Claude Code skills are quietly eating your tokens

#claude-code#skills#security#tokens

Skills are the easiest way to teach Claude Code something new, and the easiest thing to install and forget. Every one you add has a small cost in every session, whether you use it or not. Bumeter puts a number on that cost, shows which skills you never touch, and lets you switch them off without losing anything.

What a skill costs

A skill is a folder under ~/.claude/skills/ with a SKILL.md file. The top of that file is a short header (frontmatter) with a name and a description; the rest is the instructions.

Claude Code does not load every skill in full. It works in two steps, and each step has its own cost:

• Always-on: the description of every enabled skill goes into every session, so the model knows the skill exists and when to use it. You pay this on every session, even if the skill never runs.
• On invoke: when the model decides to use a skill, the whole SKILL.md is loaded. You pay this each time it runs.

Ten skills with a few hundred tokens of description each is a few thousand tokens before you have typed anything. It is not dramatic for one session, but it is in all of them.

How Bumeter measures it

Bumeter estimates both numbers from the text itself: the description for the always-on cost, the whole file for the on-invoke cost, at about 3.5 characters per token. These are marked as estimates everywhere they appear. For skills that come from Claude Code plugins, Bumeter asks the official claude plugin command for its per-component table instead of guessing.

Then it looks at what you actually did. Each time a skill runs, Claude Code records it in the session log, and Bumeter attributes the turn to that skill. A skill keeps getting credit for the turns that follow it, until you go quiet for 30 minutes or the context is compacted, because that is usually still the same piece of work. Slash commands are counted on their own. That gives every skill a usage count, its tokens per call and the last time it ran.

In a terminal, bum skills list shows all of it:

Always-on cost: ~2140 tok/session · 3 unused for 30 days (~610 tok)
SKILL                                 BASE    /CALL  USES   AVG/CALL  LAST
● code-review                           96     1840    41      52300  2026-10-19
● pdf                                  120     3900     2      18400  2026-09-02
● brainstorming                         88     2650     0          —  —  💡 unused for 30 days

A skill counts as "unused" only when it is enabled, has an always-on cost and has not run for 30 days. A skill you installed last week is not flagged yet: it has not had the chance.

Switching skills off without losing them

Disabling a skill in Bumeter moves its folder from skills/ to skills-disabled/. Claude Code no longer sees it, so its always-on cost is gone from the next session. Nothing is deleted.

Every change goes through the same steps:

1. Plan. Bumeter lists exactly what will move and where.
2. Confirm. In the app you click Confirm. In the terminal you add --yes; without it, bum skills disable only prints the plan, changes nothing and exits with an error code.
3. Journal. The change is written to a journal with an id.
4. Undo. bum skills undo <id> (or the Undo button) puts the files back.

A few details matter for real setups. If a skill is a symlink, for example into a dotfiles repository, only the link moves; the folder it points to is never touched. A skill you uninstall goes to a trash folder rather than being deleted, and the trash is emptied after 30 days. And every change takes effect from the next Claude Code session, which the plan says.

The --yes rule is there for AI agents. An agent exploring your machine might run bum skills disable to "see what it does". With this rule, all it sees is the plan.

Spotting a skill that should not be there

Skills are instructions that run with your permissions, and many come from strangers on the internet. bum skills audit reads every installed SKILL.md and reports lines worth a second look:

It also lists skills that duplicate each other, which cost twice and confuse the model about which one to use.

Every finding comes with the line it matched and a one-line reason, because these are heuristics, not verdicts. A skill that says "never run rm -rf ~" mentions a dangerous command to warn against it; Bumeter notices the warning words and lowers that to a warning instead of an alarm. The scan never changes or moves anything. It exits with an error code only when there is a high-severity finding, so you can run it in a script, with --json for the details.

Finding new skills

The app's Skills screen can also search skills.sh, a public catalogue of skills, and install one. Installing clones the skill's GitHub repository and copies the right folder in, through the same plan, confirm and journal steps. Run the audit on anything new before you rely on it.

What to do with this

• Open the Skills screen (or run bum skills list) and sort by always-on cost.
• Disable what you have not used in a month. You can undo it in one click.
• Look at skills with a large on-invoke cost that you use often: a shorter SKILL.md saves tokens every time.
• Run bum skills audit after installing anything from someone you do not know.