ghostling-libghostty-terminal
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
libghostty-vtlibrary from the official Ghostty release domain (release.files.ghostty.org) and theraylibsource code from its official GitHub repository during the build process. - [COMMAND_EXECUTION]: Provides instructions for standard build operations, including cloning the project repository and using CMake and Ninja to compile the C source code.
- [INDIRECT_PROMPT_INJECTION]: Documents a software architecture that processes potentially untrusted data from a pseudo-terminal (PTY), creating a standard attack surface for terminal emulators.
- Ingestion points: Data is read from a PTY and passed to the
ghostty_terminal_writefunction (as described in code snippets intended formain.c). - Boundary markers: The PTY communication stream does not use explicit boundary markers to separate terminal control sequences from user data.
- Capability inventory: The skill includes templates for spawning and managing shell processes via
forkandexecl(in the PTY setup section ofSKILL.md), granting the application shell-level access. - Sanitization: The skill relies on the external
libghostty-vtlibrary for parsing and sanitizing incoming terminal sequences.
Audit Metadata