model-usage

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The Python script scripts/model_usage.py invokes the codexbar command-line utility using subprocess.check_output. The command arguments for the provider are strictly validated against a predefined list of allowed values (codex, claude), which prevents arbitrary command injection.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the codexbar CLI, which is hosted in a third-party Homebrew tap (steipete/tap/codexbar). This is an external dependency necessary for the skill's functionality.
  • [DATA_EXPOSURE]: The script includes an --input flag that allows it to read from arbitrary file paths or standard input. This is designed to process exported cost JSON data, but it grants the capability to read local files if a path is provided.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 05:35 PM
Security Audit — agent-trust-hub — model-usage