From 10525231276f1c90185ba4c4c6557aac683f5133 Mon Sep 17 00:00:00 2001
From: iyashjayesh <er.yashjayeshchauhan@gmail.com>
Date: Wed, 9 Sep 2026 11:50:14 +0530
Subject: [PATCH 1/5] feat(commands): add token-card command

---
 .claude-plugin/marketplace.json |  2 +-
 .claude-plugin/plugin.json      |  2 +-
 AGENTS.md                       |  4 +-
 COMMANDS-QUICK-REF.md           |  1 +
 README.md                       |  4 +-
 README.zh-CN.md                 |  2 +-
 agent.yaml                      |  1 +
 commands/token-card.md          | 70 +++++++++++++++++++++++++++++++++
 docs/COMMAND-REGISTRY.json      | 13 +++++-
 docs/tr/AGENTS.md               |  4 +-
 docs/zh-CN/AGENTS.md            |  4 +-
 docs/zh-CN/README.md            |  6 +--
 12 files changed, 97 insertions(+), 16 deletions(-)
 create mode 100644 commands/token-card.md

diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index 4f3624062..acc0a4183 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -11,7 +11,7 @@
     {
       "name": "ecc",
       "source": "./",
-      "description": "Harness-native ECC operator layer - 68 agents, 286 skills, 94 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses",
+      "description": "Harness-native ECC operator layer - 68 agents, 286 skills, 95 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses",
       "version": "2.2.1",
       "author": {
         "name": "Affaan Mustafa",
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index f3e48987a..75a663370 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "ecc",
   "version": "2.2.1",
-  "description": "Harness-native ECC plugin for engineering teams - 68 agents, 286 skills, 94 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses",
+  "description": "Harness-native ECC plugin for engineering teams - 68 agents, 286 skills, 95 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses",
   "author": {
     "name": "Affaan Mustafa",
     "url": "https://x.com/affaanmustafa"
diff --git a/AGENTS.md b/AGENTS.md
index 98f6f0ff4..4e5e04fb7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,6 +1,6 @@
 # Everything Claude Code (ECC) — Agent Instructions
 
-This is a **production-ready AI coding plugin** providing 68 specialized agents, 286 skills, 94 commands, and automated hook workflows for software development.
+This is a **production-ready AI coding plugin** providing 68 specialized agents, 286 skills, 95 commands, and automated hook workflows for software development.
 
 **Version:** 2.2.1
 
@@ -155,7 +155,7 @@ Troubleshoot failures: check test isolation → verify mocks → fix implementat
 ```
 agents/          — 68 specialized subagents
 skills/          — 286 workflow skills and domain knowledge
-commands/        — 94 slash commands
+commands/        — 95 slash commands
 hooks/           — Trigger-based automations
 rules/           — Always-follow guidelines (common + per-language)
 scripts/         — Cross-platform Node.js utilities
diff --git a/COMMANDS-QUICK-REF.md b/COMMANDS-QUICK-REF.md
index 6a9fa22e2..ae52f0d14 100644
--- a/COMMANDS-QUICK-REF.md
+++ b/COMMANDS-QUICK-REF.md
@@ -224,6 +224,7 @@ These lifecycle commands are also available through the `ecc` CLI.
 | `/setup-pm` | Configure package manager (npm / pnpm / yarn / bun) |
 | `/auto-update` | Pull the latest ECC repo changes and reinstall the current managed targets |
 | `/cost-report` | Generate a local Claude Code cost report from a cost-tracker SQLite database |
+| `/token-card` | Render a token-usage stat card from local agent session logs and commit it to the repo |
 | `/security-scan` | Run AgentShield against agent, hook, MCP, permission, and secret surfaces |
 | `/jira` | Retrieve a Jira ticket, analyze requirements, update status, or add comments |
 | `/pr` | Create a GitHub PR from current branch with unpushed commits |
diff --git a/README.md b/README.md
index 091836e33..6974af89b 100644
--- a/README.md
+++ b/README.md
@@ -162,13 +162,13 @@ Instead of rebuilding that process in every prompt, you install it once and make
 
 ECC is MIT-licensed open source. It works best with Claude Code today, has a supported Codex sync path, and provides capability-limited adapters for Cursor, OpenCode, Gemini, Zed, GitHub Copilot, Antigravity, Qwen, and other harnesses. See the [support status matrix](#platform-support) before assuming feature parity.
 
-Access to 68 agents, 286 skills, and 94 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work.
+Access to 68 agents, 286 skills, and 95 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work.
 
 | Included         |       Count | What it gives you                                                                    |
 | ---------------- | ----------: | ------------------------------------------------------------------------------------ |
 | Agents           |   68 agents | Planning, review, build repair, security, architecture, and domain work              |
 | Skills           |  286 skills | TDD, research, security, docs, frontend, data, ML, operations, and more              |
-| Commands         | 94 commands | Convenient entry points while ECC moves to a skills-first surface                    |
+| Commands         | 95 commands | Convenient entry points while ECC moves to a skills-first surface                    |
 | Hooks and memory |     Runtime | Enforcement, session summaries, continuous learning, instincts, and context controls |
 | Rules            |   Selective | Always-loaded standards you choose by language or project                            |
 | AgentShield      |    Included | Scanning for prompts, hooks, MCP config, permissions, secrets, and agent files       |
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 8eb90eba8..753539cdc 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -196,7 +196,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/"
 /plugin list ecc@ecc
 ```
 
-**完成！** 你现在可以使用 68 个代理、286 个技能和 94 个命令。
+**完成！** 你现在可以使用 68 个代理、286 个技能和 95 个命令。
 
 ### multi-* 命令需要额外配置
 
diff --git a/agent.yaml b/agent.yaml
index ff7abe065..5aa9b2aec 100644
--- a/agent.yaml
+++ b/agent.yaml
@@ -250,6 +250,7 @@ commands:
   - skill-create
   - skill-health
   - test-coverage
+  - token-card
   - update-codemaps
   - update-docs
   - vue-review
diff --git a/commands/token-card.md b/commands/token-card.md
new file mode 100644
index 000000000..37fb6ce5a
--- /dev/null
+++ b/commands/token-card.md
@@ -0,0 +1,70 @@
+---
+description: Render a token-usage stat card from local agent session logs and commit it to the repo.
+argument-hint: [--out PATH] [--theme auto|light|dark] [--dry-run]
+---
+
+# Token Card
+
+## Purpose
+
+Produce an SVG card summarising this machine's AI coding agent usage — total tokens,
+equivalent API cost, current streak, and the split across agents — and write it into the
+working tree as a file the README can reference.
+
+The card is a committed artifact rather than a hosted image, so it renders from the
+repository itself and does not depend on a third-party endpoint staying up.
+
+## Relationship to `/cost-report`
+
+They read different sources and produce different things, so both are useful:
+
+| | `/cost-report` | `/token-card` |
+|---|---|---|
+| Source | `~/.claude/metrics/costs.jsonl`, written by ECC's `stop:cost-tracker` hook | The agents' own session logs |
+| Agents | Claude Code | Claude Code, Codex, OpenCode |
+| Output | Terminal summary, optional CSV | An SVG file committed to the repo |
+
+Use `/cost-report` to answer "what did I spend this week". Use `/token-card` to put a
+current figure in a README.
+
+## Usage
+
+```
+/token-card                       # write ./tokenchit.svg
+/token-card --out docs/usage.svg  # write somewhere else
+/token-card --theme dark
+/token-card --dry-run             # report what would be written, write nothing
+```
+
+## Workflow
+
+1. Check whether `.tokenchit.json` exists in the repository root. If it does not, run
+   `npx -y @tokenchit/cli@latest init` to detect which agents have logs on this machine and
+   record them. That file is meant to be committed and never contains a credential.
+2. Run `npx -y @tokenchit/cli@latest sync` with any arguments the user supplied. This reads
+   only local files and makes no network request, so it is safe before deciding whether to
+   publish anything.
+3. Report the figures it prints — tokens, equivalent cost, streak, per-agent split — and the
+   path it wrote.
+4. If the repository has a README and the card is not referenced yet, offer to add the
+   image reference. Do not edit the README without asking.
+
+Stop after step 3 unless the user asks to publish. `sync` is local-only; joining the public
+leaderboard is a separate `publish` command that requires an explicit opt-in, and
+`unpublish` removes the row and the account again.
+
+## Output
+
+The path of the SVG that was written, the figures it contains, and the markdown snippet for
+referencing it:
+
+```markdown
+![tokenchit](./tokenchit.svg)
+```
+
+## Notes
+
+- Requires Node.js. Nothing is installed globally; `npx` fetches the CLI per invocation.
+- Reads token counts and timestamps only. Prompts, code, and file contents are never parsed
+  or transmitted.
+- `@tokenchit/cli` is MIT licensed: <https://github.com/iyashjayesh/tokenchit>
diff --git a/docs/COMMAND-REGISTRY.json b/docs/COMMAND-REGISTRY.json
index 29b1cd647..dc7c258bc 100644
--- a/docs/COMMAND-REGISTRY.json
+++ b/docs/COMMAND-REGISTRY.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "totalCommands": 94,
+  "totalCommands": 95,
   "commands": [
     {
       "command": "aside",
@@ -990,6 +990,15 @@
       "skills": [],
       "path": "commands/test-coverage.md"
     },
+    {
+      "command": "token-card",
+      "description": "Render a token-usage stat card from local agent session logs and commit it to the repo.",
+      "type": "testing",
+      "primaryAgents": [],
+      "allAgents": [],
+      "skills": [],
+      "path": "commands/token-card.md"
+    },
     {
       "command": "update-codemaps",
       "description": "Scan project structure and generate token-lean architecture codemaps.",
@@ -1034,7 +1043,7 @@
       "planning": 2,
       "refactoring": 1,
       "review": 15,
-      "testing": 53
+      "testing": 54
     },
     "topAgents": [
       {
diff --git a/docs/tr/AGENTS.md b/docs/tr/AGENTS.md
index 97d8a07c0..000b09c03 100644
--- a/docs/tr/AGENTS.md
+++ b/docs/tr/AGENTS.md
@@ -1,6 +1,6 @@
 # Everything Claude Code (ECC) — Agent Talimatları
 
-Bu, yazılım geliştirme için 68 özel agent, 286 skill, 94 command ve otomatik hook iş akışları sağlayan **üretime hazır bir AI kodlama eklentisidir**.
+Bu, yazılım geliştirme için 68 özel agent, 286 skill, 95 command ve otomatik hook iş akışları sağlayan **üretime hazır bir AI kodlama eklentisidir**.
 
 **Sürüm:** 2.2.1
 
@@ -143,7 +143,7 @@ Başarısızlık sorunlarını giderin: test izolasyonunu kontrol edin → mockl
 ```
 agents/          — 68 özel subagent
 skills/          — 286 iş akışı skillleri ve alan bilgisi
-commands/        — 94 slash command
+commands/        — 95 slash command
 hooks/           — Tetikleyici tabanlı otomasyonlar
 rules/           — Her zaman uyulması gereken kurallar (ortak + dile özel)
 scripts/         — Platformlar arası Node.js yardımcı programları
diff --git a/docs/zh-CN/AGENTS.md b/docs/zh-CN/AGENTS.md
index 871719a16..d8e3f3757 100644
--- a/docs/zh-CN/AGENTS.md
+++ b/docs/zh-CN/AGENTS.md
@@ -1,6 +1,6 @@
 # Everything Claude Code (ECC) — 智能体指令
 
-这是一个**生产就绪的 AI 编码插件**，提供 68 个专业代理、286 项技能、94 条命令以及自动化钩子工作流，用于软件开发。
+这是一个**生产就绪的 AI 编码插件**，提供 68 个专业代理、286 项技能、95 条命令以及自动化钩子工作流，用于软件开发。
 
 **版本:** 2.2.1
 
@@ -148,7 +148,7 @@
 ```
 agents/          — 68 个专业子代理
 skills/          — 286 个工作流技能和领域知识
-commands/        — 94 个斜杠命令
+commands/        — 95 个斜杠命令
 hooks/           — 基于触发的自动化
 rules/           — 始终遵循的指导方针（通用 + 每种语言）
 scripts/         — 跨平台 Node.js 实用工具
diff --git a/docs/zh-CN/README.md b/docs/zh-CN/README.md
index c8c0e3228..0de6fad64 100644
--- a/docs/zh-CN/README.md
+++ b/docs/zh-CN/README.md
@@ -260,7 +260,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/"
 /plugin list ecc@ecc
 ```
 
-**搞定！** 你现在可以使用 68 个智能体、286 项技能和 94 个命令了。
+**搞定！** 你现在可以使用 68 个智能体、286 项技能和 95 个命令了。
 
 ***
 
@@ -1173,7 +1173,7 @@ opencode
 | 功能特性 | Claude Code   | OpenCode | 状态 |
 |---------|---------------|----------|--------|
 | 智能体 | PASS: 68 个    | PASS: 12 个 | **Claude Code 领先** |
-| 命令 | PASS: 94 个    | PASS: 35 个 | **Claude Code 领先** |
+| 命令 | PASS: 95 个    | PASS: 35 个 | **Claude Code 领先** |
 | 技能 | PASS: 286 项   | PASS: 37 项 | **Claude Code 领先** |
 | 钩子 | PASS: 8 种事件类型 | PASS: 11 种事件 | **OpenCode 更多！** |
 | 规则 | PASS: 29 条    | PASS: 13 条指令 | **Claude Code 领先** |
@@ -1281,7 +1281,7 @@ ECC 是**第一个最大化利用每个主要 AI 编码工具的插件**。以
 | 功能特性 | Claude Code           | Cursor IDE | Codex CLI | OpenCode |
 |---------|-----------------------|------------|-----------|----------|
 | **智能体** | 68                    | 共享 (AGENTS.md) | 共享 (AGENTS.md) | 12 |
-| **命令** | 94                    | 共享 | 基于指令 | 35 |
+| **命令** | 95                    | 共享 | 基于指令 | 35 |
 | **技能** | 286                   | 共享 | 10 (原生格式) | 37 |
 | **钩子事件** | 8 种类型                 | 15 种类型 | SessionStart（1 种类型） | 11 种类型 |
 | **钩子脚本** | 20+ 个脚本               | 16 个脚本 (DRY 适配器) | 1 个 SessionStart 引导脚本 | 插件钩子 |

From 51fe0e91635c384105fe1314f35dc99bbfc9f824 Mon Sep 17 00:00:00 2001
From: iyashjayesh <er.yashjayeshchauhan@gmail.com>
Date: Wed, 9 Sep 2026 12:58:07 +0530
Subject: [PATCH 2/5] Move token-card to a skill, pin the CLI, and fix three
 doc contradictions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses the review on #3039. Four findings, all of them real.

Skills-first (Greptile P2). AGENTS.md says commands/ exists for compatibility and
the direction is skills-first, so the workflow now lives in skills/token-card
and commands/token-card.md is a thin shim pointing at it — 70 lines down to 28.

Unpinned remote code (CodeRabbit major, Greptile P1, CWE-494). The workflow ran
`npx -y @tokenchit/cli@latest` and handed whatever the registry currently serves
read access to local session logs. It is pinned to 0.7.0, the skill says to raise
the pin knowingly, gives the `npm view … dist.integrity` check, and step 1 is now
an explicit confirmation before the first download on a machine.

The "no network request" claim was false as written (both bots). `sync` sends
nothing, but the npx invocation around it is a registry download, and the
sentence read as though the whole step were offline. It now separates the two.

`--dry-run` wrote a file (Greptile P2). Step 1 created `.tokenchit.json` via
`init` before `sync --dry-run` ran, so a documented no-op mutated the tree.
Initialisation is skipped on a dry run and reported as prospective instead.

The README offer was unreachable (Greptile P2). "Stop after step 3" sat directly
below step 4, so the step that puts the card in the README — the whole point —
could never run. The boundary moved to after step 4; publishing still requires
being asked for by name.

Wiring: agent.yaml skills list, manifests/install-modules.json under
operator-workflows (beside cost-tracking and ecc-tools-cost-audit), and
package.json `files`, which the npm-publish-surface test requires to track the
module graph. `yarn install --mode=update-lockfile` leaves yarn.lock byte
identical, so nothing to commit there. docs/tr/AGENTS.md carries two skill counts
the catalog sync does not reach, both 286 -> 287.

npm test: 4396 passed, 0 failed. markdownlint clean on both files.
---
 .claude-plugin/marketplace.json |   2 +-
 .claude-plugin/plugin.json      |   2 +-
 AGENTS.md                       |   4 +-
 README.md                       |   4 +-
 README.zh-CN.md                 |   2 +-
 agent.yaml                      |   1 +
 commands/token-card.md          |  62 ++++---------------
 docs/COMMAND-REGISTRY.json      |  12 ++--
 docs/tr/AGENTS.md               |   4 +-
 docs/zh-CN/AGENTS.md            |   4 +-
 docs/zh-CN/README.md            |   6 +-
 manifests/install-modules.json  |   1 +
 package.json                    |   1 +
 skills/token-card/SKILL.md      | 102 ++++++++++++++++++++++++++++++++
 14 files changed, 136 insertions(+), 71 deletions(-)
 create mode 100644 skills/token-card/SKILL.md

diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index acc0a4183..4ade1b5de 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -11,7 +11,7 @@
     {
       "name": "ecc",
       "source": "./",
-      "description": "Harness-native ECC operator layer - 68 agents, 286 skills, 95 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses",
+      "description": "Harness-native ECC operator layer - 68 agents, 287 skills, 95 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses",
       "version": "2.2.1",
       "author": {
         "name": "Affaan Mustafa",
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index 75a663370..9dc28739d 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "ecc",
   "version": "2.2.1",
-  "description": "Harness-native ECC plugin for engineering teams - 68 agents, 286 skills, 95 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses",
+  "description": "Harness-native ECC plugin for engineering teams - 68 agents, 287 skills, 95 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses",
   "author": {
     "name": "Affaan Mustafa",
     "url": "https://x.com/affaanmustafa"
diff --git a/AGENTS.md b/AGENTS.md
index 4e5e04fb7..0391df9c5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,6 +1,6 @@
 # Everything Claude Code (ECC) — Agent Instructions
 
-This is a **production-ready AI coding plugin** providing 68 specialized agents, 286 skills, 95 commands, and automated hook workflows for software development.
+This is a **production-ready AI coding plugin** providing 68 specialized agents, 287 skills, 95 commands, and automated hook workflows for software development.
 
 **Version:** 2.2.1
 
@@ -154,7 +154,7 @@ Troubleshoot failures: check test isolation → verify mocks → fix implementat
 
 ```
 agents/          — 68 specialized subagents
-skills/          — 286 workflow skills and domain knowledge
+skills/          — 287 workflow skills and domain knowledge
 commands/        — 95 slash commands
 hooks/           — Trigger-based automations
 rules/           — Always-follow guidelines (common + per-language)
diff --git a/README.md b/README.md
index 6974af89b..ecf33fe0f 100644
--- a/README.md
+++ b/README.md
@@ -162,12 +162,12 @@ Instead of rebuilding that process in every prompt, you install it once and make
 
 ECC is MIT-licensed open source. It works best with Claude Code today, has a supported Codex sync path, and provides capability-limited adapters for Cursor, OpenCode, Gemini, Zed, GitHub Copilot, Antigravity, Qwen, and other harnesses. See the [support status matrix](#platform-support) before assuming feature parity.
 
-Access to 68 agents, 286 skills, and 95 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work.
+Access to 68 agents, 287 skills, and 95 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work.
 
 | Included         |       Count | What it gives you                                                                    |
 | ---------------- | ----------: | ------------------------------------------------------------------------------------ |
 | Agents           |   68 agents | Planning, review, build repair, security, architecture, and domain work              |
-| Skills           |  286 skills | TDD, research, security, docs, frontend, data, ML, operations, and more              |
+| Skills           |  287 skills | TDD, research, security, docs, frontend, data, ML, operations, and more              |
 | Commands         | 95 commands | Convenient entry points while ECC moves to a skills-first surface                    |
 | Hooks and memory |     Runtime | Enforcement, session summaries, continuous learning, instincts, and context controls |
 | Rules            |   Selective | Always-loaded standards you choose by language or project                            |
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 753539cdc..589032fd1 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -196,7 +196,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/"
 /plugin list ecc@ecc
 ```
 
-**完成！** 你现在可以使用 68 个代理、286 个技能和 95 个命令。
+**完成！** 你现在可以使用 68 个代理、287 个技能和 95 个命令。
 
 ### multi-* 命令需要额外配置
 
diff --git a/agent.yaml b/agent.yaml
index 5aa9b2aec..abcde4c2a 100644
--- a/agent.yaml
+++ b/agent.yaml
@@ -152,6 +152,7 @@ skills:
   - tdd-workflow
   - team-builder
   - token-budget-advisor
+  - token-card
   - unified-memory
   - verification-loop
   - video-editing
diff --git a/commands/token-card.md b/commands/token-card.md
index 37fb6ce5a..8c537b827 100644
--- a/commands/token-card.md
+++ b/commands/token-card.md
@@ -1,31 +1,13 @@
 ---
-description: Render a token-usage stat card from local agent session logs and commit it to the repo.
+description: Render a token-usage stat card from local agent session logs and commit it to the repo. Invokes the token-card skill.
 argument-hint: [--out PATH] [--theme auto|light|dark] [--dry-run]
 ---
 
 # Token Card
 
-## Purpose
-
-Produce an SVG card summarising this machine's AI coding agent usage — total tokens,
-equivalent API cost, current streak, and the split across agents — and write it into the
-working tree as a file the README can reference.
-
-The card is a committed artifact rather than a hosted image, so it renders from the
-repository itself and does not depend on a third-party endpoint staying up.
-
-## Relationship to `/cost-report`
-
-They read different sources and produce different things, so both are useful:
-
-| | `/cost-report` | `/token-card` |
-|---|---|---|
-| Source | `~/.claude/metrics/costs.jsonl`, written by ECC's `stop:cost-tracker` hook | The agents' own session logs |
-| Agents | Claude Code | Claude Code, Codex, OpenCode |
-| Output | Terminal summary, optional CSV | An SVG file committed to the repo |
-
-Use `/cost-report` to answer "what did I spend this week". Use `/token-card` to put a
-current figure in a README.
+Thin compatibility shim. The workflow lives in the **token-card** skill
+(`skills/token-card/SKILL.md`), which is the canonical surface; this command exists so the
+slash-command harnesses can reach it.
 
 ## Usage
 
@@ -36,35 +18,11 @@ current figure in a README.
 /token-card --dry-run             # report what would be written, write nothing
 ```
 
-## Workflow
+## What it does
 
-1. Check whether `.tokenchit.json` exists in the repository root. If it does not, run
-   `npx -y @tokenchit/cli@latest init` to detect which agents have logs on this machine and
-   record them. That file is meant to be committed and never contains a credential.
-2. Run `npx -y @tokenchit/cli@latest sync` with any arguments the user supplied. This reads
-   only local files and makes no network request, so it is safe before deciding whether to
-   publish anything.
-3. Report the figures it prints — tokens, equivalent cost, streak, per-agent split — and the
-   path it wrote.
-4. If the repository has a README and the card is not referenced yet, offer to add the
-   image reference. Do not edit the README without asking.
+Renders an SVG card of this machine's AI coding agent usage — tokens, equivalent cost,
+streak, per-agent split — from local Claude Code, Codex and OpenCode session logs, and writes
+it into the working tree as a file the README can reference.
 
-Stop after step 3 unless the user asks to publish. `sync` is local-only; joining the public
-leaderboard is a separate `publish` command that requires an explicit opt-in, and
-`unpublish` removes the row and the account again.
-
-## Output
-
-The path of the SVG that was written, the figures it contains, and the markdown snippet for
-referencing it:
-
-```markdown
-![tokenchit](./tokenchit.svg)
-```
-
-## Notes
-
-- Requires Node.js. Nothing is installed globally; `npx` fetches the CLI per invocation.
-- Reads token counts and timestamps only. Prompts, code, and file contents are never parsed
-  or transmitted.
-- `@tokenchit/cli` is MIT licensed: <https://github.com/iyashjayesh/tokenchit>
+Follow the skill for the full workflow, including the confirmation required before the first
+registry download, the pinned CLI version, and the dry-run rules.
diff --git a/docs/COMMAND-REGISTRY.json b/docs/COMMAND-REGISTRY.json
index dc7c258bc..c5b76b617 100644
--- a/docs/COMMAND-REGISTRY.json
+++ b/docs/COMMAND-REGISTRY.json
@@ -992,11 +992,13 @@
     },
     {
       "command": "token-card",
-      "description": "Render a token-usage stat card from local agent session logs and commit it to the repo.",
-      "type": "testing",
+      "description": "Render a token-usage stat card from local agent session logs and commit it to the repo. Invokes the token-card skill.",
+      "type": "general",
       "primaryAgents": [],
       "allAgents": [],
-      "skills": [],
+      "skills": [
+        "token-card"
+      ],
       "path": "commands/token-card.md"
     },
     {
@@ -1038,12 +1040,12 @@
   "statistics": {
     "byType": {
       "build": 2,
-      "general": 10,
+      "general": 11,
       "orchestration": 11,
       "planning": 2,
       "refactoring": 1,
       "review": 15,
-      "testing": 54
+      "testing": 53
     },
     "topAgents": [
       {
diff --git a/docs/tr/AGENTS.md b/docs/tr/AGENTS.md
index 000b09c03..fec63aafb 100644
--- a/docs/tr/AGENTS.md
+++ b/docs/tr/AGENTS.md
@@ -1,6 +1,6 @@
 # Everything Claude Code (ECC) — Agent Talimatları
 
-Bu, yazılım geliştirme için 68 özel agent, 286 skill, 95 command ve otomatik hook iş akışları sağlayan **üretime hazır bir AI kodlama eklentisidir**.
+Bu, yazılım geliştirme için 68 özel agent, 287 skill, 95 command ve otomatik hook iş akışları sağlayan **üretime hazır bir AI kodlama eklentisidir**.
 
 **Sürüm:** 2.2.1
 
@@ -142,7 +142,7 @@ Başarısızlık sorunlarını giderin: test izolasyonunu kontrol edin → mockl
 
 ```
 agents/          — 68 özel subagent
-skills/          — 286 iş akışı skillleri ve alan bilgisi
+skills/          — 287 iş akışı skillleri ve alan bilgisi
 commands/        — 95 slash command
 hooks/           — Tetikleyici tabanlı otomasyonlar
 rules/           — Her zaman uyulması gereken kurallar (ortak + dile özel)
diff --git a/docs/zh-CN/AGENTS.md b/docs/zh-CN/AGENTS.md
index d8e3f3757..30598bfaf 100644
--- a/docs/zh-CN/AGENTS.md
+++ b/docs/zh-CN/AGENTS.md
@@ -1,6 +1,6 @@
 # Everything Claude Code (ECC) — 智能体指令
 
-这是一个**生产就绪的 AI 编码插件**，提供 68 个专业代理、286 项技能、95 条命令以及自动化钩子工作流，用于软件开发。
+这是一个**生产就绪的 AI 编码插件**，提供 68 个专业代理、287 项技能、95 条命令以及自动化钩子工作流，用于软件开发。
 
 **版本:** 2.2.1
 
@@ -147,7 +147,7 @@
 
 ```
 agents/          — 68 个专业子代理
-skills/          — 286 个工作流技能和领域知识
+skills/          — 287 个工作流技能和领域知识
 commands/        — 95 个斜杠命令
 hooks/           — 基于触发的自动化
 rules/           — 始终遵循的指导方针（通用 + 每种语言）
diff --git a/docs/zh-CN/README.md b/docs/zh-CN/README.md
index 0de6fad64..ce8704120 100644
--- a/docs/zh-CN/README.md
+++ b/docs/zh-CN/README.md
@@ -260,7 +260,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/"
 /plugin list ecc@ecc
 ```
 
-**搞定！** 你现在可以使用 68 个智能体、286 项技能和 95 个命令了。
+**搞定！** 你现在可以使用 68 个智能体、287 项技能和 95 个命令了。
 
 ***
 
@@ -1174,7 +1174,7 @@ opencode
 |---------|---------------|----------|--------|
 | 智能体 | PASS: 68 个    | PASS: 12 个 | **Claude Code 领先** |
 | 命令 | PASS: 95 个    | PASS: 35 个 | **Claude Code 领先** |
-| 技能 | PASS: 286 项   | PASS: 37 项 | **Claude Code 领先** |
+| 技能 | PASS: 287 项   | PASS: 37 项 | **Claude Code 领先** |
 | 钩子 | PASS: 8 种事件类型 | PASS: 11 种事件 | **OpenCode 更多！** |
 | 规则 | PASS: 29 条    | PASS: 13 条指令 | **Claude Code 领先** |
 | MCP 服务器 | PASS: 14 个    | PASS: 完整 | **完全对等** |
@@ -1282,7 +1282,7 @@ ECC 是**第一个最大化利用每个主要 AI 编码工具的插件**。以
 |---------|-----------------------|------------|-----------|----------|
 | **智能体** | 68                    | 共享 (AGENTS.md) | 共享 (AGENTS.md) | 12 |
 | **命令** | 95                    | 共享 | 基于指令 | 35 |
-| **技能** | 286                   | 共享 | 10 (原生格式) | 37 |
+| **技能** | 287                   | 共享 | 10 (原生格式) | 37 |
 | **钩子事件** | 8 种类型                 | 15 种类型 | SessionStart（1 种类型） | 11 种类型 |
 | **钩子脚本** | 20+ 个脚本               | 16 个脚本 (DRY 适配器) | 1 个 SessionStart 引导脚本 | 插件钩子 |
 | **规则** | 34 (通用 + 语言)          | 34 (YAML 前页) | 基于指令 | 13 条指令 |
diff --git a/manifests/install-modules.json b/manifests/install-modules.json
index 0e45965a5..93d924913 100644
--- a/manifests/install-modules.json
+++ b/manifests/install-modules.json
@@ -558,6 +558,7 @@
         "skills/messages-ops",
         "skills/project-flow-ops",
         "skills/terminal-ops",
+        "skills/token-card",
         "skills/unified-notifications-ops",
         "skills/workspace-surface-audit",
         "skills/mailtrap-email-integration"
diff --git a/package.json b/package.json
index 70f136fc9..42bd2a6b9 100644
--- a/package.json
+++ b/package.json
@@ -337,6 +337,7 @@
     "skills/terminal-opener/",
     "skills/terminal-ops/",
     "skills/token-budget-advisor/",
+    "skills/token-card/",
     "skills/ui-demo/",
     "skills/ui-to-vue/",
     "skills/unified-memory/",
diff --git a/skills/token-card/SKILL.md b/skills/token-card/SKILL.md
new file mode 100644
index 000000000..be93c599e
--- /dev/null
+++ b/skills/token-card/SKILL.md
@@ -0,0 +1,102 @@
+---
+name: token-card
+description: Render a token-usage stat card from local Claude Code, Codex, and OpenCode session logs and commit it into the repository as a file. Use when someone wants a current usage figure in a README, or asks for a shareable card of their coding-agent activity.
+metadata:
+  origin: community
+---
+
+# Token Card
+
+Produce an SVG card summarising this machine's AI coding agent usage — total tokens,
+equivalent API cost, current streak, and the split across agents — and write it into the
+working tree as a file the README can reference.
+
+The card is a committed artifact rather than a hosted image, so it renders from the
+repository itself and does not depend on a third-party endpoint staying up.
+
+## When to Use
+
+- Someone wants a usage figure visible in a README or docs page.
+- Someone asks for a shareable summary of their agent activity across tools.
+
+Use `/cost-report` instead when the question is "what did I spend this week". The two read
+different sources and produce different things:
+
+| | `/cost-report` | Token Card |
+|---|---|---|
+| Source | `~/.claude/metrics/costs.jsonl`, written by ECC's `stop:cost-tracker` hook | The agents' own session logs |
+| Agents | Claude Code | Claude Code, Codex, OpenCode |
+| Output | Terminal summary, optional CSV | An SVG file committed to the repo |
+
+## The tool this runs
+
+`@tokenchit/cli`, MIT licensed: <https://github.com/iyashjayesh/tokenchit>
+
+**Pinned to an exact version, deliberately.** `@latest` resolves to whatever the registry
+currently serves, and this tool reads local session logs — so a compromised future release
+would be executed with access to them before anyone had reviewed it. Pin, and raise the pin
+knowingly:
+
+```bash
+TOKENCHIT_VERSION=0.7.0
+```
+
+To check the pinned artifact before running it the first time:
+
+```bash
+npm view @tokenchit/cli@0.7.0 dist.integrity dist.tarball
+```
+
+## Workflow
+
+1. **Ask before the first download.** `npx` fetches the package from the npm registry and
+   executes it. That is a remote download of code that will read local logs, so get explicit
+   confirmation from the user before the first run on a machine. If they decline, stop here
+   and say what would have run.
+
+2. **Configure, unless this is a dry run.** If `.tokenchit.json` is absent, run:
+
+   ```bash
+   npx -y @tokenchit/cli@0.7.0 init
+   ```
+
+   It detects which agents have logs on this machine and records them. The file is meant to
+   be committed and never contains a credential.
+
+   **Skip this entirely when the user passed `--dry-run`**, and report that `.tokenchit.json`
+   *would* be created. A preview that writes a config file is not a preview.
+
+3. **Render the card:**
+
+   ```bash
+   npx -y @tokenchit/cli@0.7.0 sync [--out PATH] [--theme auto|light|dark] [--dry-run]
+   ```
+
+   `sync` reads local files and sends nothing: no prompts, no code, no file contents leave
+   the machine, and it transmits nothing to any server. The npx invocation around it is a
+   registry download — that is the network access in this workflow, and step 1 is where it
+   is agreed.
+
+4. **Report and offer.** Print the figures it produced — tokens, equivalent cost, streak,
+   per-agent split — and the path written. If the repository has a README that does not yet
+   reference the card, offer to add:
+
+   ```markdown
+   ![tokenchit](./tokenchit.svg)
+   ```
+
+   Do not edit the README without being asked.
+
+Stop after step 4. Publishing to the public leaderboard is a separate `publish` command that
+requires explicit opt-in, and is not part of this workflow — run it only if the user asks for
+it by name. `unpublish` removes the row and the account again.
+
+## Output
+
+The path of the SVG, the figures it contains, and the markdown snippet for referencing it.
+On a dry run: what would have been written, and nothing on disk changed.
+
+## Notes
+
+- Requires Node.js. Nothing is installed globally; `npx` fetches the pinned version per run.
+- Reads token counts and timestamps only.

From 7899734c643c75014090598d390ad3441c62d3ac Mon Sep 17 00:00:00 2001
From: iyashjayesh <er.yashjayeshchauhan@gmail.com>
Date: Sun, 27 Sep 2026 01:35:40 +0530
Subject: [PATCH 3/5] Stop the documented sync command writing a card on a dry
 run
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The workflow's step 3 was an executable block containing placeholders:

    npx -y @tokenchit/cli@0.10.0 sync [--out PATH] [--theme auto|light|dark] [--dry-run]

Copied as written, that does not fail. `sync` ignores an unrecognised
positional argument rather than refusing it, and `[--dry-run]` is positional —
so the brackets are discarded and a real sync runs. Verified against the
published 0.10.0: the literal command exits 0 and writes tokenchit.svg, 10,144
bytes, while `--dry-run` spelled properly writes nothing. An agent following
this skill for a preview would have changed the working tree.

Step 3 now shows one bare runnable command and moves the options into a table,
so nothing inside a bash block is a placeholder. Three reviewers flagged this
shape — it was the standing merge-risk note on the PR — and it was still live.

Also states the Node floor. The skill said only "Requires Node.js"; the package
declares engines node >=22, so anyone on 20 met a confusing failure instead of
a clear precondition.
---
 skills/token-card/SKILL.md | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/skills/token-card/SKILL.md b/skills/token-card/SKILL.md
index 453b16637..0d7b21fa4 100644
--- a/skills/token-card/SKILL.md
+++ b/skills/token-card/SKILL.md
@@ -66,12 +66,23 @@ npm view @tokenchit/cli@0.10.0 dist.integrity dist.tarball
    **Skip this entirely when the user passed `--dry-run`**, and report that `.tokenchit.json`
    *would* be created. A preview that writes a config file is not a preview.
 
-3. **Render the card:**
+3. **Render the card.** The bare command, which writes `tokenchit.svg` in the repository root:
 
    ```bash
-   npx -y @tokenchit/cli@0.10.0 sync [--out PATH] [--theme auto|light|dark] [--dry-run]
+   npx -y @tokenchit/cli@0.10.0 sync
    ```
 
+   Append only the flags the user actually asked for, each spelled exactly as below. Do not
+   copy a placeholder into the command — `sync` ignores an unrecognised positional argument
+   rather than refusing it, so a bracketed `[--dry-run]` reaches the CLI as junk and the card
+   is written anyway, which is the opposite of what was asked.
+
+   | Flag | Effect |
+   |---|---|
+   | `--out <path>` | Write somewhere other than `tokenchit.svg` |
+   | `--theme auto` \| `light` \| `dark` | Card theme; `auto` adapts to the reader's system |
+   | `--dry-run` | Print what would be written and touch nothing |
+
    `sync` reads local files and sends nothing: no prompts, no code, no file contents leave
    the machine, and it transmits nothing to any server. The npx invocation around it is a
    registry download — that is the network access in this workflow, and step 1 is where it
@@ -98,5 +109,6 @@ On a dry run: what would have been written, and nothing on disk changed.
 
 ## Notes
 
-- Requires Node.js. Nothing is installed globally; `npx` fetches the pinned version per run.
+- Requires Node.js 22 or newer (the package declares `engines: { node: ">=22" }`). Nothing is
+  installed globally; `npx` fetches the pinned version per run.
 - Reads token counts and timestamps only.

From df34108e0fa5d680aaef3c8ac8e397c108a7d886 Mon Sep 17 00:00:00 2001
From: iyashjayesh <er.yashjayeshchauhan@gmail.com>
Date: Sun, 27 Sep 2026 01:43:14 +0530
Subject: [PATCH 4/5] Do not promise an output path the config can override
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review caught this on the previous commit, and it was right. `sync` resolves
its target as `--out` if given, otherwise `.tokenchit.json`'s `output` —
`tokenchit.svg` is that field's default, not a fixed location. Saying the bare
command "writes tokenchit.svg in the repository root" is wrong for anyone who
has configured another path.

Checked rather than assumed: a config with `output: docs/custom-card.svg` makes
the bare command report `would write docs/custom-card.svg`.

Three places said it. Step 3 now says the configured output, the flag table no
longer implies the default is fixed, and the README snippet carries a note to
use the path sync actually reported. The command's usage comment says the same.
---
 commands/token-card.md     | 2 +-
 skills/token-card/SKILL.md | 8 ++++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/commands/token-card.md b/commands/token-card.md
index 9c4f78abe..db7a200d5 100644
--- a/commands/token-card.md
+++ b/commands/token-card.md
@@ -12,7 +12,7 @@ slash-command harnesses can reach it.
 ## Usage
 
 ```
-/token-card                       # write ./tokenchit.svg
+/token-card                       # write the configured output (./tokenchit.svg by default)
 /token-card --out docs/usage.svg  # write somewhere else
 /token-card --theme dark
 /token-card --dry-run             # report what would be written, write nothing
diff --git a/skills/token-card/SKILL.md b/skills/token-card/SKILL.md
index 0d7b21fa4..2451edf5e 100644
--- a/skills/token-card/SKILL.md
+++ b/skills/token-card/SKILL.md
@@ -66,7 +66,8 @@ npm view @tokenchit/cli@0.10.0 dist.integrity dist.tarball
    **Skip this entirely when the user passed `--dry-run`**, and report that `.tokenchit.json`
    *would* be created. A preview that writes a config file is not a preview.
 
-3. **Render the card.** The bare command, which writes `tokenchit.svg` in the repository root:
+3. **Render the card.** The bare command writes to the configured output — `tokenchit.svg`
+   unless `.tokenchit.json` names another path:
 
    ```bash
    npx -y @tokenchit/cli@0.10.0 sync
@@ -79,7 +80,7 @@ npm view @tokenchit/cli@0.10.0 dist.integrity dist.tarball
 
    | Flag | Effect |
    |---|---|
-   | `--out <path>` | Write somewhere other than `tokenchit.svg` |
+   | `--out <path>` | Write somewhere other than the configured output |
    | `--theme auto` \| `light` \| `dark` | Card theme; `auto` adapts to the reader's system |
    | `--dry-run` | Print what would be written and touch nothing |
 
@@ -96,6 +97,9 @@ npm view @tokenchit/cli@0.10.0 dist.integrity dist.tarball
    ![tokenchit](./tokenchit.svg)
    ```
 
+   Use the path `sync` actually reported, not this one, when the output is configured
+   elsewhere.
+
    Do not edit the README without being asked.
 
 Stop after step 4. Publishing to the public leaderboard is a separate `publish` command that

From 99e75b70f9dd0656f51a87e689218ebd412f3eaa Mon Sep 17 00:00:00 2001
From: iyashjayesh <er.yashjayeshchauhan@gmail.com>
Date: Sun, 27 Sep 2026 02:24:12 +0530
Subject: [PATCH 5/5] Make the offered README link relative to the README being
 edited
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review caught this on the note added last commit, and it was right again. `sync`
prints the card's path relative to the repository root; a Markdown image
resolves relative to the file it sits in. Telling the agent to reuse the
printed path is correct only for a README at the root.

Verified: with output `docs/usage.svg`, sync prints `./docs/usage.svg`. Pasted
into `docs/zh-CN/README.md` that resolves to `docs/zh-CN/docs/usage.svg` — the
card exists, the image is broken. The nested README needs `../usage.svg`.

The note now says to rewrite the path for the target file and gives both forms.
---
 skills/token-card/SKILL.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/skills/token-card/SKILL.md b/skills/token-card/SKILL.md
index 2451edf5e..20b1b98fe 100644
--- a/skills/token-card/SKILL.md
+++ b/skills/token-card/SKILL.md
@@ -97,8 +97,11 @@ npm view @tokenchit/cli@0.10.0 dist.integrity dist.tarball
    ![tokenchit](./tokenchit.svg)
    ```
 
-   Use the path `sync` actually reported, not this one, when the output is configured
-   elsewhere.
+   `sync` prints the path relative to the repository root. A Markdown image resolves
+   relative to the file it sits in, so rewrite it for the README being edited: a card at
+   `docs/usage.svg` is `./docs/usage.svg` from the root README but `../usage.svg` from
+   `docs/zh-CN/README.md`. Pasting the printed path into a nested README points at
+   `docs/zh-CN/docs/usage.svg` and renders broken.
 
    Do not edit the README without being asked.