ghostty-use
Warn
Audited by Socket on Oct 8, 2026
1 alert found:
AnomalyAnomalyscripts/ghostty_session.py
LOWAnomalyLOW
scripts/ghostty_session.py
The fragment appears to implement a local session snapshot and restoration utility, not malware. Its restore workflow can execute arbitrary commands if a snapshot contains a malicious `restore_command` or the profile environment file contains a malicious prefix. Treat these files and the dynamically loaded history-reader as trusted inputs; avoid restoring untrusted snapshots and consider rejecting or safely tokenizing custom commands.
Confidence: 98%Severity: 68%
Audit Metadata