ghostty-use
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTIONPRIVILEGE_ESCALATIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses system utilities including
psandlsofto monitor running terminal sessions and their working directories. It employsosascriptto perform GUI automation in the Ghostty terminal by simulating keystrokes to open new tabs and paste commands. - [PERSISTENCE]: The
ghostty_watch.pyscript provides functionality to install a macOSlaunchdLaunchAgent. This mechanism ensures that the session observation script runs periodically and automatically starts when the user logs in, maintaining the snapshot lifecycle across system reboots. - [DYNAMIC_EXECUTION]: The skill dynamically loads a Python module (
read_codex_session.py) from a path determined at runtime via theGHOSTTY_CODEX_HISTORY_READERenvironment variable or a CLI argument. This is used to integrate with a vendor-linked history reading dependency. - [PRIVILEGE_ESCALATION]: To automate user interface actions in Ghostty, the skill requires macOS Accessibility permissions. The documentation guides the user to grant these elevated permissions to
System Eventsto allow for keystroke injection. - [DATA_EXPOSURE]: The skill accesses and reads local terminal transcript files from the user's home directory (
~/.claude/and~/.codex/) to extract session metadata and liveness information. It also captures process command-line arguments which may contain sensitive context. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and parses the content of terminal transcript files to classify session health and liveness. This ingestion of data from session logs creates an attack surface for indirect prompt injection if those logs contain adversarial instructions.
Audit Metadata