writing-statuslines
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/update-docs.pyis designed to fetch documentation fromhttps://code.claude.com/docs/en/statusline.md. This URL points to an official Anthropic domain for Claude Code. - [COMMAND_EXECUTION]: The
SKILL.mdfile contains a setup command that executes the bundledscripts/update-docs.pyscript. This is used to synchronize the reference materials with the latest documentation. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of status line scripts that ingest session metadata—such as the current working directory, session ID, and cost data—from the platform via stdin. This is an inherent part of the feature's design.
- Ingestion points: Generated status line scripts receive a JSON payload containing session context via standard input (stdin).
- Boundary markers: The skill does not explicitly require input sanitization, but the provided examples demonstrate structured parsing.
- Capability inventory: These status line scripts typically utilize basic shell utilities, Python, or Node.js to format the UI output.
- Sanitization: The provided documentation examples utilize standard JSON parsing (e.g.,
jq,json.load,JSON.parse) to extract specific fields safely.
Audit Metadata