The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/model_usage.py executes the codexbar command using subprocess.check_output to retrieve usage data. The command is invoked using a list of arguments, which is a secure practice that prevents shell injection.
[EXTERNAL_DOWNLOADS]: The skill metadata specifies the installation of the codexbar CLI tool via Homebrew from a third-party tap (steipete/tap/codexbar). This is the primary dependency required for the skill's functionality.
[DATA_EXPOSURE]: The skill is designed to process local usage logs (typically found in ~/.codex/ and ~/.claude/ via the CLI tool). The processing is performed entirely locally, and no evidence of data exfiltration or network transmission of these logs was detected.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The scripts/model_usage.py script reads JSON data from the codexbar CLI output, local files via the --input flag, or standard input.
Boundary markers: None present in the prompt interpolation.
Capability inventory: The script includes file read operations and subprocess execution of the codexbar command.
Sanitization: Input data is parsed using the standard json library, and the script performs structural validation on the expected keys (e.g., modelBreakdowns, provider) before processing.

model-usage