ghostty-use

Warn

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTIONPRIVILEGE_ESCALATIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses system utilities including ps and lsof to monitor running terminal sessions and their working directories. It employs osascript to perform GUI automation in the Ghostty terminal by simulating keystrokes to open new tabs and paste commands.
  • [PERSISTENCE]: The ghostty_watch.py script provides functionality to install a macOS launchd LaunchAgent. This mechanism ensures that the session observation script runs periodically and automatically starts when the user logs in, maintaining the snapshot lifecycle across system reboots.
  • [DYNAMIC_EXECUTION]: The skill dynamically loads a Python module (read_codex_session.py) from a path determined at runtime via the GHOSTTY_CODEX_HISTORY_READER environment variable or a CLI argument. This is used to integrate with a vendor-linked history reading dependency.
  • [PRIVILEGE_ESCALATION]: To automate user interface actions in Ghostty, the skill requires macOS Accessibility permissions. The documentation guides the user to grant these elevated permissions to System Events to allow for keystroke injection.
  • [DATA_EXPOSURE]: The skill accesses and reads local terminal transcript files from the user's home directory (~/.claude/ and ~/.codex/) to extract session metadata and liveness information. It also captures process command-line arguments which may contain sensitive context.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and parses the content of terminal transcript files to classify session health and liveness. This ingestion of data from session logs creates an attack surface for indirect prompt injection if those logs contain adversarial instructions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 8, 2026, 03:07 AM