model-usage

Pass

Audited by Gen Agent Trust Hub on Jul 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes the codexbar CLI tool using subprocess.check_output in scripts/model_usage.py. The arguments are passed as a list and the variable provider is validated against a strict set of choices (codex, claude) via argparse, preventing command injection.
  • [EXTERNAL_DOWNLOADS]: The skill specifies a dependency on the codexbar CLI, which is installed via the steipete/tap/codexbar Homebrew cask. This is a legitimate external tool required for the skill's primary functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 9, 2026, 10:45 PM
Security Audit — agent-trust-hub — model-usage