model-usage
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The Python script
scripts/model_usage.pyinvokes thecodexbarCLI utility usingsubprocess.check_output. The implementation is secure as it passes arguments as a list rather than a raw shell string. Furthermore, the variable input (provider) is strictly validated against a whitelist of allowed values (codex,claude) viaargparse, effectively neutralizing command injection risks. - [EXTERNAL_DOWNLOADS]: The skill metadata specifies a dependency on the
codexbarCLI, which is installed via the Homebrew package manager from a specific third-party tap (steipete/tap/codexbar). This is a standard installation procedure for macOS-based developer tools.
Audit Metadata