ClawHub
Back to skill

Security audit

Ccusage Report

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Claude Code usage reporter, but it depends on running an automatically fetched third-party CLI.

Install only if you are comfortable letting a third-party ccusage CLI read local Claude Code session data to calculate usage. For stronger assurance, prefer a pinned ccusage version and verify the timezone used in reports, especially for billing-sensitive daily totals.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:30
Finding

Unpinned Third-Party Package Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–32
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

json
{ "tool": "exec", "command": "bunx ccusage daily --no-color -z Europe/Paris -o desc --since $(date +%Y%m%d) --until $(date +%Y%m%d)" }

The related documentation in README.md, line 12, confirms that the dependency is retrieved automatically:

text
No setup required. `ccusage` is fetched automatically via `bunx`.

Technical Analysis

The skill instructs the agent to execute ccusage through bunx without specifying an exact package version, lockfile, integrity hash, or trusted registry constraint. Consequently, the package resolved and executed during a future invocation may differ from the package available when the skill was audited.

This creates a supply-chain trust boundary because bunx may retrieve package code from an external package registry and execute it with the privileges of the agent process. If the package, publisher account, registry resolution path, or an upstream dependency is compromised, malicious code could be delivered without any modification to this skill.

The audit did not establish that the current ccusage package is malicious. The vulnerability is the mutable and unverified dependency execution mechanism.

Attack Path

  1. An attacker compromises the relevant package publisher, package version, registry resolution path, or upstream dependency.
  2. The attacker publishes a malicious release that resolves under the unpinned ccusage package name.
  3. A user asks the agent for a Claude Code usage or cost report.
  4. Following SKILL.md, the agent invokes bunx ccusage.
  5. bunx resolves and retrieves the attacker-controlled package version.
  6. The downloaded package executes locally under the agent process identity.
  7. The payload can access resources available to that identity, including local session data used to generate the ...[truncated 584 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin ccusage to a reviewed exact version, for example:

    json
    { "tool": "exec", "command": "bunx ccusage@X.Y.Z daily --no-color -z Europe/Paris -o desc --since $(date +%Y%m%d) --until $(date +%Y%m%d)" }

  2. Use a lockfile and package-manager integrity verification where supported, and commit the lockfile to the reviewed artifact.

  3. Configure an approved registry explicitly rather than relying on ambient package-manager configuration.

  4. Verify package provenance, publisher identity, checksums, and signatures before approving version updates.

  5. Run the dependency with least privilege in a sandbox that restricts filesystem, environment-variable, and network access.

  6. Establish a controlled update process in which dependency changes are reviewed and tested before deployment.

  7. Update every command and example consistently so no documented path continues to invoke an unpinned package.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill hard-codes -z Europe/Paris in the command used to generate usage reports, which can silently produce inaccurate daily boundaries and cost summaries for users in other regions. Because the skill explicitly maps user requests like 'today' and 'last 7 days' to date-based reports, using the wrong timezone can misstate spending and usage in a way that affects billing interpretation and operational decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The line 'Translate all prompts and examples to English' suggests the skill enforces a specific language. Under the policy rules, forcing a language without user choice or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.