A fast, dependency-light, starship-inspired status line for Claude Code.
SaferSkills independently audited cosmobar (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Configure cosmobar by interviewing the user, then apply the result with one command. Do not hardcode the list of segments or themes — read them live from the binary so this stays correct as cosmobar gains new segments.
cosmobar --version.curl -sS https://raw.githubusercontent.com/oleksbard/cosmobar/main/install.sh | sh then stop and let them install.
cosmobar segments --json → array of segments, each with name, description, default_on, requires_git, pro_max_only.cosmobar themes --json → array of theme names.description. Pre-select the ones where default_on is true. Mention that pro_max_only segments only show data on Pro/Max plans, and requires_git segments only appear inside a git repo. Let the user pick the set to show. The order they end up with is the left-to-right display order.coral).24h, 12h, or off.auto (default) or ascii — pick ascii only if their terminal can't render block characters like ▓░.lean (default), tick, or blocks (background pills). All styles are font-free — there is no Nerd Font / powerline option.soft (default) or square. For lean or tick, do not ask about caps at all. AskUserQuestion can't branch mid-batch, so put style in the first batch and send the caps question separately afterwards, only if style came back blocks.on (default) or off. When on, a segment's value briefly scrambles through symbols and "decodes" into its new value whenever it changes — purely visual, width-stable. Offer off for users who want a completely static bar.rate_limits is enabled): both (default), 5h, or 7d.cost is enabled): show today's cross-session spend (· $5.30 today) on the cost segment — today (default) to show, empty to hide.rate_limits is enabled): on (default) or off. When on, the 5-hour window shows its spend, e.g. 5h 31% $4.20 (2h30m left).~/.config/cosmobar/config.toml AND wires ~/.claude/settings.json (backing up the previous file): cosmobar init --force --theme <THEME> --order <comma,separated,enabled,segments> --clock <24h|12h|off> --glyphs <auto|ascii> --style <lean|tick|blocks> [--caps <soft|square>] --rate-window <both|5h|7d> [--animate <on|off>] [--cost-rollups today] [--block-cost <on|off>]--order is the comma-separated list of the segments the user enabled, in their chosen order.--force overwrites any existing config (this is a reconfigure).--caps is only relevant when --style blocks is used — omit it otherwise.--rate-window is only relevant when rate_limits is included in --order.--animate on|off toggles the value-change scramble animation (default on).--cost-rollups is only relevant when cost is in --order — pass today to show the today rollup (the default), or omit to keep it.--block-cost on|off is only relevant when rate_limits is in --order — shows the 5h block's spend (default on)./cosmobar anytime, or hand-edit ~/.config/cosmobar/config.toml and check it with cosmobar preview. Don't ask follow-up questions.cosmobar uninstall removes the statusline wiring (add --purge to also delete the config and the binary).cosmobar doctor reports whether the binary, config, color support, and wiring are all healthy.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.