model-usage
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The
model_usage.pyscript executes thecodexbarCLI tool using thesubprocessmodule. The command is constructed as a list with fixed arguments and validated provider choices, preventing shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
codexbarCLI tool via Homebrew from a specific tap (steipete/tap/codexbar). This external dependency is necessary for the skill's primary function of model usage reporting. - [DATA_EXFILTRATION]: The skill reads local LLM session logs (e.g., from
~/.codex/or~/.claude/) via thecodexbartool to aggregate cost data. This access is restricted to the intended function of cost summarization and does not involve any external network transmission of user data.
Audit Metadata