starship-customization
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary function is to help an AI agent generate shell commands for inclusion in
starship.tomlconfiguration files. The instructions provide specific guidance to prevent common mistakes, such as pinning the shell selection to['sh', '-c']or similar non-interactive flags to prevent infinite recursion and reduce latency. - [EXTERNAL_DOWNLOADS]: Several recipes include commands that fetch data from external sources, including the NPM registry (for version checking) and
wttr.in(for weather glyphs). These references target well-known technology services and include caching logic to minimize network overhead and prompt lag. - [DATA_EXPOSURE]: The skill provides templates for displaying environment-specific information like AWS profiles, GCP projects, and Tailscale connection status. These access local environment variables or run local CLI tools to provide status updates within the user's own terminal session.
- [INDIRECT_PROMPT_INJECTION]: The skill handles project-local data ingestion (reading from
package.json,pyproject.toml, or CI status files). The provided documentation explicitly warns against enablingunsafe_no_escape, which ensures that data read from the filesystem is not interpreted by the shell prompt as instructions or escape sequences, maintaining a secure boundary between data and the terminal interface.
Audit Metadata