starship-customization

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill's primary function is to help an AI agent generate shell commands for inclusion in starship.toml configuration files. The instructions provide specific guidance to prevent common mistakes, such as pinning the shell selection to ['sh', '-c'] or similar non-interactive flags to prevent infinite recursion and reduce latency.
  • [EXTERNAL_DOWNLOADS]: Several recipes include commands that fetch data from external sources, including the NPM registry (for version checking) and wttr.in (for weather glyphs). These references target well-known technology services and include caching logic to minimize network overhead and prompt lag.
  • [DATA_EXPOSURE]: The skill provides templates for displaying environment-specific information like AWS profiles, GCP projects, and Tailscale connection status. These access local environment variables or run local CLI tools to provide status updates within the user's own terminal session.
  • [INDIRECT_PROMPT_INJECTION]: The skill handles project-local data ingestion (reading from package.json, pyproject.toml, or CI status files). The provided documentation explicitly warns against enabling unsafe_no_escape, which ensures that data read from the filesystem is not interpreted by the shell prompt as instructions or escape sequences, maintaining a secure boundary between data and the terminal interface.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 06:55 AM
Security Audit — agent-trust-hub — starship-customization