carbon-update
Update claude-carbon to the latest version and re-price history (CO2-only)
Install this skill
or
64/100
Security score
The carbon-update skill was audited on Sep 16, 2026 and we found 8 security issues across 2 threat categories, including 2 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
high line 39
Piping content to bash shell
SourceSKILL.md
| 37 | echo "claude-carbon updater not found at ${REPO_DIR}/scripts/update.sh" |
| 38 | echo "Re-run the installer to update:" |
| 39 | echo " curl -fsSL https://raw.githubusercontent.com/gwittebolle/claude-carbon/main/install.sh | bash" |
| 40 | fi |
| 41 | ``` |
low line 22
Command substitution pattern
SourceSKILL.md
| 20 | esac |
| 21 | } |
| 22 | SETTINGS="$(ccp "${CLAUDE_CONFIG_DIR:-$HOME/.claude}")/settings.json" |
| 23 | if command -v jq >/dev/null 2>&1 && [ -f "$SETTINGS" ]; then |
| 24 | SL_CMD="$(jq -r '.statusLine.command // empty' "$SETTINGS" 2>/dev/null)" |
low line 24
Command substitution pattern
SourceSKILL.md
| 22 | SETTINGS="$(ccp "${CLAUDE_CONFIG_DIR:-$HOME/.claude}")/settings.json" |
| 23 | if command -v jq >/dev/null 2>&1 && [ -f "$SETTINGS" ]; then |
| 24 | SL_CMD="$(jq -r '.statusLine.command // empty' "$SETTINGS" 2>/dev/null)" |
| 25 | # statusLine.command stores a shell-escaped path: expand ~ and unescape spaces |
| 26 | SL_CMD="${SL_CMD//\\ / }"; SL_CMD="${SL_CMD/#\~/$HOME}"; SL_CMD="$(ccp "$SL_CMD")" |
low line 26
Command substitution pattern
SourceSKILL.md
| 24 | SL_CMD="$(jq -r '.statusLine.command // empty' "$SETTINGS" 2>/dev/null)" |
| 25 | # statusLine.command stores a shell-escaped path: expand ~ and unescape spaces |
| 26 | SL_CMD="${SL_CMD//\\ / }"; SL_CMD="${SL_CMD/#\~/$HOME}"; SL_CMD="$(ccp "$SL_CMD")" |
| 27 | if [ -n "$SL_CMD" ] && [ -f "$SL_CMD" ]; then |
| 28 | REPO_DIR="$(cd "$(dirname "$SL_CMD")/.." 2>/dev/null && pwd)" |
low line 28
Command substitution pattern
SourceSKILL.md
| 26 | SL_CMD="${SL_CMD//\\ / }"; SL_CMD="${SL_CMD/#\~/$HOME}"; SL_CMD="$(ccp "$SL_CMD")" |
| 27 | if [ -n "$SL_CMD" ] && [ -f "$SL_CMD" ]; then |
| 28 | REPO_DIR="$(cd "$(dirname "$SL_CMD")/.." 2>/dev/null && pwd)" |
| 29 | fi |
| 30 | fi |
low line 31
Command substitution pattern
SourceSKILL.md
| 29 | fi |
| 30 | fi |
| 31 | [ -z "$REPO_DIR" ] && [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && REPO_DIR="$(ccp "$CLAUDE_PLUGIN_ROOT")" |
| 32 | [ -z "$REPO_DIR" ] && REPO_DIR="$(ccp "${CLAUDE_CARBON_DIR:-$HOME/code/claude-carbon}")" |
| 33 |
low line 32
Command substitution pattern
SourceSKILL.md
| 30 | fi |
| 31 | [ -z "$REPO_DIR" ] && [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && REPO_DIR="$(ccp "$CLAUDE_PLUGIN_ROOT")" |
| 32 | [ -z "$REPO_DIR" ] && REPO_DIR="$(ccp "${CLAUDE_CARBON_DIR:-$HOME/code/claude-carbon}")" |
| 33 | |
| 34 | if [ -f "${REPO_DIR}/scripts/update.sh" ]; then |
high line 39
Curl pipe to interpreter
SourceSKILL.md
| 37 | echo "claude-carbon updater not found at ${REPO_DIR}/scripts/update.sh" |
| 38 | echo "Re-run the installer to update:" |
| 39 | echo " curl -fsSL https://raw.githubusercontent.com/gwittebolle/claude-carbon/main/install.sh | bash" |
| 40 | fi |
| 41 | ``` |
Scanned on Sep 16, 2026
View Security Dashboard