claude-usage-analyst
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
ccusageutility via a well-known service (NPM) using the commandnpm install -g ccusage@latest. This is a primary dependency required for the skill's core functionality. - [COMMAND_EXECUTION]: The bundled Python script
scripts/analyze_claude_usage.pyusessubprocess.runto execute theccusageCLI. The execution is handled safely by passing arguments as a list and avoiding a shell environment, which prevents command injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local usage logs processed by the
ccusagetool. While this creates an indirect injection surface if the logs were to contain malicious instructions, the script strictly parses the JSON output into numeric and categorical data for table generation, providing a structured boundary that significantly reduces the risk of the agent misinterpreting data as instructions.
Audit Metadata