statuslin.esSubmit

How statuslin.es checks mods and status lines

Every status line and mod passes these four checks before you can install it, and every update passes them again.

1

Pinned to one version

A mod is pinned to one commit of its GitHub repository, and a status line to the SHA-256 hash of its script. Installing gets you that version, whatever the author pushes later.

{
  "name": "token-weather-usage",
  "source": {
    "source": "git-subdir",
    "url": "https://github.com/augiefra/claude-mods.git",
    "path": "plugins/token-weather-usage",
    "sha": "550611d4f8092fd4b97358ad6faa8e7bf01ca5bb"
  }
}

Token Weather Usage's entry in statuslin.es/marketplace.json, the file Claude Code installs mods from. Its sha is the pinned commit.

2

Run in a sandbox

Before it's listed, it runs in a fresh sandbox that records the previews on its page. A status line runs in 8 sample sessions, and a mod in the terminal and in Claude Desktop. The sandbox can't reach the internet unless the hosts it needs are approved, and it's thrown away after each run.

Clean repo
╭─ CONTEXT ────────────────────────────────────────────╮ │ ████▊░░░░░░░░░░░░░░░░░ 22% of 200K · GOOD │ ├─ STATS ──────────────────────────────────────────────┤ │ ↓ 44.0K ↑ 1.4K │ $0.41 │ ⏱ 10m 12s │ +128/-34 │ ├─ REPO ───────────────────────────────────────────────┤ │ ◆ Opus 4.8 · main · 16:21 │ ╰──────────────────────────────────────────────────────╯
New session
╭─ CONTEXT ──────────────────────────────────────╮ │ ░░░░░░░░░░░░░░░░░░░░░░ 0% of 200K · GOOD │ ├─ STATS ────────────────────────────────────────┤ │ ↓ 0 ↑ 0 │ $0.00 │ ⏱ 10m 12s │ ├─ REPO ─────────────────────────────────────────┤ │ ◆ Opus 4.8 · main · 16:21 │ ╰────────────────────────────────────────────────╯
Dirty branch
╭─ CONTEXT ────────────────────────────────────────────╮ │ ██████████▌░░░░░░░░░░░ 48% of 200K · GOOD │ ├─ STATS ──────────────────────────────────────────────┤ │ ↓ 96.0K ↑ 1.4K │ $0.41 │ ⏱ 10m 12s │ +128/-34 │ ├─ REPO ───────────────────────────────────────────────┤ │ ◆ Sonnet 4.6 · feat/auth ~1 ?1 · 16:21 I │ ╰──────────────────────────────────────────────────────╯

Dreambase Panel, as the sandbox recorded it.

The sandbox is only for previews

Installed, a status line or mod runs on your machine with your permissions.

3

Reviewed before it's listed

When a status line is submitted, checks look for hidden or encoded code and for reads of credentials such as SSH or AWS keys, and refuse it if they find either. Nothing goes live on its own. Review looks at:

  • Its source, at the pinned version
  • The previews the sandbox recorded
  • The hosts it asks to connect to, and whether it reads your Claude login
  • For a mod, the events it hooks and the $ calls it makes, from claude plugin validate

An update is a new version and goes through every step again. The live version stays up until the update is approved.

4

Listed with what it can reach

Its page shows what it can reach, right by the install button. For a mod, that comes from its footprint. For a status line, it comes from the checks on its script and the hosts approved for it. None of it comes from the author's description.

What this mod can do

  • Reviewed at commit 550611d
  • Reads environment variables
3 more things it can do
  • Remembers data between sessions
  • Lists running subagents
  • Runs on a timer
Good to know (3)
  • On a subscription, the dollar figures are API-price equivalents, not a bill
  • Labels come in English, French or Russian; pick one under Language in /config
  • Hover cards with reset times and cost splits appear only in the desktop app
Are mods safe?

Token Weather Usage's panel, as its own page shows it.

If something turns up after it's listed, the listing can come down at once.

All of it is open source

statuslin.es is open source. The sandbox, the checks on submitted scripts, the review queue and /marketplace.json are code in its public repository, so you can read exactly what each step does.

Read it at statuslin.es on GitHub. If you find a way around a check, SECURITY.md says how to report it.

What review can't promise

  • Review lowers the risk. It can't rule it out.
  • A reviewer can miss something.
  • Read the source from its page before you install, and again before you update.

Are Claude Code mods safe? covers what a mod can do once installed and how to check one yourself.