claude-hud
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of established and widely-used Node.js packages (blessed, blessed-contrib, chalk, ws) from the official npm registry to support its terminal dashboard and communication features.- [INDIRECT_PROMPT_INJECTION]: The skill processes and displays external data, including tool inputs/outputs and token usage metrics, creating a potential surface for indirect prompt injection. * Ingestion points: Data enters the context via API response headers in context-monitor.js and WebSocket messages in server.js. * Boundary markers: Content is handled as structured JSON without explicit delimiters for embedded instructions. * Capability inventory: The skill facilitates terminal UI rendering and maintains a local WebSocket server. * Sanitization: The implementation uses string truncation for displayed tool data and provides explicit guidelines to avoid logging sensitive code, mitigating the risk of data exposure.
Audit Metadata