The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the subprocess module (via Popen and run calls in portable.py, run.py, and various usage scripts) to execute local AI provider command-line interfaces such as claude, codex, grok, muse, and agy. These calls are used to query the provider's own usage endpoints or local agent servers as part of the primary reporting function.
[EXTERNAL_DOWNLOADS]: The cursorbench.py script performs HTTP GET requests to https://cursor.com/cursorbench and https://artificialanalysis.ai/ to retrieve public model performance and cost benchmarks. These connections do not transmit user credentials or sensitive session data.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from local session logs, which constitutes an ingestion point for untrusted external data.
Ingestion points: Local session and transcript files (e.g., ~/.claude/projects/*.jsonl, ~/.codex/sessions/**/*.jsonl, ~/.grok/sessions/**/summary.json) are read by session_info.py to extract model identifiers.
Boundary markers: No specific boundary markers or instructions are present to prevent the agent from interpreting instructions that might be embedded in the logs.
Capability inventory: The skill possesses the capability to execute commands via subprocess and perform network requests via urllib.
Sanitization: External data is parsed as structured JSON/JSONL, and only specific metadata fields (like model name and effort) are extracted for the report, limiting the attack surface.

ai-usage