ghostling-libghostty-terminal

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the libghostty-vt library from the official Ghostty release domain (release.files.ghostty.org) and the raylib source code from its official GitHub repository during the build process.
  • [COMMAND_EXECUTION]: Provides instructions for standard build operations, including cloning the project repository and using CMake and Ninja to compile the C source code.
  • [INDIRECT_PROMPT_INJECTION]: Documents a software architecture that processes potentially untrusted data from a pseudo-terminal (PTY), creating a standard attack surface for terminal emulators.
  • Ingestion points: Data is read from a PTY and passed to the ghostty_terminal_write function (as described in code snippets intended for main.c).
  • Boundary markers: The PTY communication stream does not use explicit boundary markers to separate terminal control sequences from user data.
  • Capability inventory: The skill includes templates for spawning and managing shell processes via fork and execl (in the PTY setup section of SKILL.md), granting the application shell-level access.
  • Sanitization: The skill relies on the external libghostty-vt library for parsing and sanitizing incoming terminal sequences.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 07:24 PM
Security Audit — agent-trust-hub — ghostling-libghostty-terminal