statusline

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill installs a shell script (statusline.sh) and configures the environment to execute it. It adds a command entry to ~/.claude/settings.json which triggers the execution of the script whenever the status line needs to be rendered.
  • [PERSISTENCE]: By modifying the global ~/.claude/settings.json file, the skill ensures that the status line script is executed across different projects and sessions of the AI agent. This behavior is consistent with the skill's stated purpose of providing a persistent status line.
  • [DYNAMIC_EXECUTION]: The statusline.sh script utilizes an eval statement to import JSON data into shell variables. It mitigates injection risks by using the jq tool's @sh filter, which is designed to safely escape values for use in shell scripts.
  • [PRIVILEGE_ESCALATION]: The installation workflow includes a chmod +x command to make the installed script executable. This is a standard administrative step for installing local scripts and does not involve acquiring elevated system permissions.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as model names and git branch information. However, the scope of the script is limited to terminal output formatting and it lacks capabilities for network communication or sensitive file modification, which minimizes the impact of potentially malicious input data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 12:09 PM