wterm
Warn
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: MEDIUMPERSISTENCECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PERSISTENCE]: The
launchd/install.shscript installs a macOS LaunchAgent by creating a property list file at~/Library/LaunchAgents/com.minoan.wterm-server.plist. This configuration ensures thewterm-serverdaemon starts automatically upon user login and is kept running in the background. - [COMMAND_EXECUTION]: The skill provides the ability to spawn and manage remote shell sessions. Specifically, the
create-session.shscript allows the agent to execute arbitrary commands (defaulting to/bin/zsh) within a Pseudo-Terminal (PTY) environment hosted by thewterm-serverdaemon. - [DATA_EXFILTRATION]: Multiple utility scripts, including
create-session.sh,kill-session.sh,list-sessions.sh, andstatus.sh, access the sensitive file path~/.config/env/secrets.envto retrieve theWTERM_AUTH_TOKEN. Accessing secret files is a data exposure risk, even when used for internal service authentication.
Audit Metadata