The Agent Skills Directory

[SAFE]: No malicious patterns, obfuscation, or security vulnerabilities were detected in the skill code or metadata.- [COMMAND_EXECUTION]: The script scripts/model_usage.py executes the codexbar CLI tool using subprocess.check_output. The command arguments are constructed from a whitelist of allowed providers ('codex', 'claude'), preventing arbitrary command injection.- [DATA_EXPOSURE]: The skill is designed to access local AI session logs (e.g., in ~/.codex/sessions/ and ~/.config/claude/) to retrieve cost and token usage metadata. This access is local and intended for the skill's primary purpose. No network-based exfiltration patterns (like curl or requests) were found.- [EXTERNAL_DOWNLOADS]: The skill metadata includes instructions to install the codexbar tool via Homebrew (steipete/tap/codexbar). This is a standard installation method for the required dependency.

model-usage