context-window-advisor
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's logic is implemented using standard Python libraries and does not involve any external package dependencies or runtime installations.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses local session logs (
~/.codex/sessions) and configuration (~/.codex/config.toml). This access is strictly limited to metadata required for usage analysis, such as token counts and growth rates. No sensitive data, such as API keys or conversation content, is targeted or exposed. - [EXTERNAL_DOWNLOADS]: The skill generates a link to a visualization tool hosted on GitHub Pages (
jacoblincool.github.io). The link contains non-sensitive, aggregate parameters for plotting usage curves. The script does not perform any network requests or automatic fetches of this URL. - [COMMAND_EXECUTION]: The skill invokes local Python scripts to perform calculations and apply settings. These operations are restricted to the user's home directory and include safety mechanisms like creating timestamped backups of configuration files before modification.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes user-generated session logs, it treats the data as structured JSON for numeric aggregation rather than natural language instructions, minimizing the risk of indirect injection attacks.
Audit Metadata