claude-usage-cli

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:31 PM UTC
• Version: 0.2.0

Overview

This skill has a legitimate usage-reporting purpose, but it should be reviewed because it installs an unpinned deprecated third-party CLI that handles an Admin API key.

Before installing, prefer the maintained replacement named by the skill or verify and pin a specific trusted version of the package. Do not enter an Anthropic Admin API key unless you trust the installed CLI code and are comfortable granting it read-only access to organization usage and cost reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned Third-Party Package and Repository Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4`, `SKILL.md:19-20`, and `SKILL.md:23-27` **Vulnerability Type**: Unpinned third-party dependency installation and execution **Risk Level**: Medium ### Vulnerable Code Metadata installation command at `SKILL.md:4`: ```yaml metadata: {"clawdbot":{"emoji":"📊","os":["macos"],"requires":{"bins":["claude-usage","node"]},"install":[{"id":"npm","kind":"shell","command":"npm install -g claude-usage-cli","bins":["claude-usage"],"label":"Install claude-usage-cli via npm"}],"source":"https://github.com/cyberash-dev/claude-usage-cli"}} ``` Documented npm installation at `SKILL.md:19-20`: ```bash npm install -g claude-usage-cli ``` Documented source installation at `SKILL.md:23-27`: ```bash git clone https://github.com/cyberash-dev/claude-usage-cli.git cd claude-usage-cli npm install && npm run build && npm link ``` ### Technical Analysis Both installation methods execute externally maintained code without pinning it to an audited package version, repository commit, or integrity digest. The global npm command resolves the package version from the registry at installation time. npm installation can execute dependency or package lifecycle scripts with the permissions of the invoking user. The source installation method clones the repository's current default branch, installs its current dependency graph, runs the repository-controlled build command, and globally links the resulting executable. Consequently, the effective code executed by these instructions can change after the Skill itself has been reviewed. The artifact contains only `SKILL.md` and `_meta.json`; it does not contain the CLI implementation or a lockfile that would allow the claims concerning Keychain storage, network destinations, and data persistence to be independently verified. No evidence in the reviewed artifact establishes that the referenced package or repository is currently malicious. The vulnerability is the absence of rep ...[truncated 1950 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm package to a specific reviewed version rather than resolving the latest release: ```bash npm install -g claude-usage-cli@<reviewed-version> ``` 2. Record and verify the expected package integrity digest before installation. Publish the verified package version and checksum in the Skill documentation. 3. For source installation, pin a full reviewed commit hash: ```bash git clone https://github.com/cyberash-dev/claude-usage-cli.git cd claude-usage-cli git checkout --detach <reviewed-full-commit-hash> ``` 4. Include and enforce a lockfile for reproducible transitive dependency resolution. Prefer `npm ci` over an unconstrained `npm install`. 5. Review npm lifecycle scripts and dependencies before installation. Use `--ignore-scripts` when lifecycle scripts are unnecessary, and run any required build step separately only after inspection. 6. Avoid global installation where possible. Install into an isolated, least-privileged environment and invoke the pinned executable through an explicit path. 7. Vendor the reviewed implementation into the audited artifact, or provide signed release artifacts with provenance attestations so the installed code can be tied to the reviewed source. 8. Update the Skill's deprecated installation metadata so automated installers do not continue installing an unmaintained and unpinned package. Prefer the actively maintained replacement only after applying the same version-pinning and integrity-verification controls. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Credential Access

High

• Category: Privilege Escalation

Content

claude-usage config show
```

Remove key from Keychain:
```bash
claude-usage config remove-key
```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

claude-usage usage                                    # Last 7 days, daily, grouped by model
claude-usage usage --period 30d                       # Last 30 days
claude-usage usage --from 2026-01-01 --to 2026-01-31 # Custom date range
claude-usage usage --model claude-sonnet-4            # Filter by model
claude-usage usage --api-keys apikey_01Rj,apikey_02Xz # Filter by API key IDs
claude-usage usage --group-by model,api_key_id        # Group by multiple dimensions
claude-usage usage --bucket 1h                        # Hourly granularity (1d, 1h, 1m)

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Static analysis

No suspicious patterns detected.