model-usage
Pass
Audited by Gen Agent Trust Hub on Mar 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/model_usage.pyinvokes thecodexbarCLI usingsubprocess.check_outputto retrieve cost data in JSON format. The command is constructed as a list, which avoids shell injection risks. - [EXTERNAL_DOWNLOADS]: The skill defines a dependency on the
codexbartool, which is installed via a third-party Homebrew tap (steipete/tap/codexbar). This is the intended installation path for the required CLI tool on macOS systems. - [DATA_EXPOSURE]: The skill analyzes local log files related to AI usage (located in
~/.codexand~/.config/claude/) to calculate costs. While these files contain metadata about model interactions, the skill only processes this information locally to generate summaries and does not exfiltrate the data.
Audit Metadata