t3-capacity
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [DATA_EXFILTRATION]: The skill reads sensitive authentication tokens from local configuration files such as
~/.claude/.credentials.json,~/.grok/auth.json,~/.codex/auth.json, and~/.config/cursor/auth.json. - On macOS, the skill executes the
securityutility to retrieve authentication secrets from the system Keychain. - These tokens are transmitted to the official usage endpoints of trusted and well-known providers, specifically
api.anthropic.comandcli-chat-proxy.grok.com, to retrieve authorized usage statistics. - [COMMAND_EXECUTION]: The skill executes local binaries and system utilities to interact with provider tools and manage execution state.
- It spawns CLI tools including
codex,cursor-agent,claude, andgrokfrom the system PATH or configured locations. - It utilizes the system
scriptutility to emulate a TTY environment required by certain CLI tools to display usage info. - It executes the macOS
securityutility to facilitate Keychain credential retrieval.
Audit Metadata