init-claude-code-statusline
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill configures the Claude Code environment to execute a local shell script (
.claude/statusline.sh) via thesettings.jsonconfiguration file. This is the documented and intended mechanism for implementing custom status bars in the target environment. - [INDIRECT_PROMPT_INJECTION]: The provided status bar script ingests JSON data from the host environment's standard input. While this involves processing external data, the script's capabilities are limited to information display.
- Ingestion points:
templates/statusline.shreads input from standard input usingcatand parses it withjq. - Boundary markers: Absent; the script relies on the expected structure of the environment-provided JSON.
- Capability inventory: The script utilizes standard tools (
git,jq,sed,awk) and an optional utility (ccusage) exclusively for read-only status reporting. - Sanitization: Variable content is handled safely using
printfwith%splaceholders, which prevents typical command or format string injection during the display phase.
- Ingestion points:
Audit Metadata