statusline
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill installs a shell script (
statusline.sh) and configures the environment to execute it. It adds a command entry to~/.claude/settings.jsonwhich triggers the execution of the script whenever the status line needs to be rendered. - [PERSISTENCE]: By modifying the global
~/.claude/settings.jsonfile, the skill ensures that the status line script is executed across different projects and sessions of the AI agent. This behavior is consistent with the skill's stated purpose of providing a persistent status line. - [DYNAMIC_EXECUTION]: The
statusline.shscript utilizes anevalstatement to import JSON data into shell variables. It mitigates injection risks by using thejqtool's@shfilter, which is designed to safely escape values for use in shell scripts. - [PRIVILEGE_ESCALATION]: The installation workflow includes a
chmod +xcommand to make the installed script executable. This is a standard administrative step for installing local scripts and does not involve acquiring elevated system permissions. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as model names and git branch information. However, the scope of the script is limited to terminal output formatting and it lacks capabilities for network communication or sensitive file modification, which minimizes the impact of potentially malicious input data.
Audit Metadata