codexbar-menubar-ai-usage-tracker
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides commands to install the application via Homebrew (
brew install --cask steipete/tap/codexbar) and directs users to download releases from the official GitHub repository (https://github.com/steipete/CodexBar/releases/latest). These are standard installation patterns for macOS software. - [COMMAND_EXECUTION]: Provides various CLI commands for configuring the application, such as
codexbar config set-api-keyandcodexbar refresh. It also includes a shell script example for cost tracking. These commands are local to the tool's intended functionality and do not exhibit malicious behavior. - [DATA_EXFILTRATION]: While the skill mentions reading browser cookies (for Cursor/Safari) and OAuth tokens (for Claude/Gemini), it does so as part of its stated purpose to track usage. The instructions correctly note that 'Full Disk Access' or Keychain permissions are required, which are standard macOS security prompts handled by the OS.
- [CREDENTIALS_UNSAFE]: The skill instructs users on how to securely set API keys using environment variables and stdin (
printf '%s' "$API_KEY" | codexbar config set-api-key --stdin), which is a recommended security practice for secret management.
Audit Metadata