init-claude-code-statusline

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill configures the Claude Code environment to execute a local shell script (.claude/statusline.sh) via the settings.json configuration file. This is the documented and intended mechanism for implementing custom status bars in the target environment.
  • [INDIRECT_PROMPT_INJECTION]: The provided status bar script ingests JSON data from the host environment's standard input. While this involves processing external data, the script's capabilities are limited to information display.
    • Ingestion points: templates/statusline.sh reads input from standard input using cat and parses it with jq.
    • Boundary markers: Absent; the script relies on the expected structure of the environment-provided JSON.
    • Capability inventory: The script utilizes standard tools (git, jq, sed, awk) and an optional utility (ccusage) exclusively for read-only status reporting.
    • Sanitization: Variable content is handled safely using printf with %s placeholders, which prevents typical command or format string injection during the display phase.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 05:50 PM