Claude Code Statusline

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears purpose-aligned, but it installs a persistent Claude Code status line command and changes local Claude settings.

This looks like a coherent local Claude Code customization. Before installing, be aware that it copies a script into ~/.claude, changes Claude settings so that script runs as the status line, and may overwrite an existing statusLine configuration. Back up ~/.claude/settings.json if you already customize Claude Code.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI05: Unexpected Code Execution

What this means

Claude Code will invoke the installed Python script when rendering the status line until the user removes it.

Why it was flagged

The installer registers a Python command in Claude Code settings. This is expected for a status line extension, but it creates ongoing local command execution.

Skill content

return f"python3 {STATUSLINE_SCRIPT}" ... data["statusLine"] = { "type": "command", "command": cmd }

Recommendation

Install only if you want a persistent status line command, and use the documented uninstall command if you no longer want it.

Info

#ASI02: Tool Misuse and Exploitation

What this means

The status line may read local git metadata for the current workspace and display it in the terminal.

Why it was flagged

The runtime script calls git in the active workspace to collect branch information. It uses an argument list rather than a shell and has a timeout, making it proportionate to the stated git-branch display feature.

Skill content

subprocess.run(["git", "-C", cwd, "symbolic-ref", "--short", "HEAD"], capture_output=True, text=True, timeout=5, env={**os.environ, "GIT_TERMINAL_PROMPT": "0"})

Recommendation

Use it only in workspaces where showing branch and ahead/behind information in the status line is acceptable.

Low

#ASI09: Human-Agent Trust Exploitation

What this means

An existing Claude Code statusLine setting in ~/.claude/settings.json may be replaced, and uninstall removes the statusLine key rather than restoring any prior command.

Why it was flagged

SKILL.md says installation updates ~/.claude/settings.local.json, while the installer code updates ~/.claude/settings.json. This is still within the Claude configuration scope, but users should know the exact file being changed.

Skill content

# 6. Update settings.json (not settings.local.json)
if update_settings_file(SETTINGS_JSON):

Recommendation

Before installing, check or back up ~/.claude/settings.json if you already have a custom status line configured.