model-usage
Pass
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The Python script
scripts/model_usage.pyexecutes thecodexbarCLI tool using thesubprocessmodule to fetch cost data. The arguments passed to the command are strictly validated against a predefined list of providers ('codex', 'claude') viaargparse, preventing command injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill documentation recommends installing the
codexbarCLI tool via a third-party Homebrew tap (steipete/tap/codexbar). While this is an external dependency, it is a standard installation method for the utility required for the skill's primary function. - [DATA_EXPOSURE]: The skill reads local usage logs (token counts and session costs) stored by the Codex and Claude desktop applications. This data is handled entirely on the local machine within the Python script and is not transmitted to any external network endpoints.
Audit Metadata