skills/aresbit/matebot2tg/model-usage/Gen Agent Trust Hub

model-usage

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The Python script scripts/model_usage.py invokes the codexbar CLI utility using subprocess.check_output. The implementation is secure as it passes arguments as a list rather than a raw shell string. Furthermore, the variable input (provider) is strictly validated against a whitelist of allowed values (codex, claude) via argparse, effectively neutralizing command injection risks.
  • [EXTERNAL_DOWNLOADS]: The skill metadata specifies a dependency on the codexbar CLI, which is installed via the Homebrew package manager from a specific third-party tap (steipete/tap/codexbar). This is a standard installation procedure for macOS-based developer tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 08:14 AM