model-usage
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The Python script
scripts/model_usage.pyinvokes thecodexbarcommand-line utility usingsubprocess.check_output. The command arguments for the provider are strictly validated against a predefined list of allowed values (codex,claude), which prevents arbitrary command injection. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
codexbarCLI, which is hosted in a third-party Homebrew tap (steipete/tap/codexbar). This is an external dependency necessary for the skill's functionality. - [DATA_EXPOSURE]: The script includes an
--inputflag that allows it to read from arbitrary file paths or standard input. This is designed to process exported cost JSON data, but it grants the capability to read local files if a path is provided.
Audit Metadata