Ccusage Report

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:14 PM UTC
• Version:
  1.0.3

Overview

The skill appears coherent for usage reporting, with a timezone accuracy caveat but no evidence of hidden, destructive, or exfiltrating behavior.

Safe to install if you understand the reporting timezone limitation. Before using the output for billing, budgeting, or operational decisions, verify whether reports are generated in `Europe/Paris` and adjust or reinterpret date ranges if you are in another timezone.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The skill hard-codes `-z Europe/Paris` when generating usage reports, which can silently produce incorrect daily, weekly, or monthly boundaries for users in other regions. Because billing and token summaries are time-bound, this can misstate spend and usage for the requested period, especially around day/week/month transitions, leading to misleading financial reporting or bad operational decisions.

VirusTotal

64/64 vendors flagged this skill as clean.