pty-oauth-login
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Python script
scripts/pty-bridge.pythat utilizesos.execvp()to execute a target command inside a pseudo-terminal. This allows non-interactive sessions to run tools that typically require a real terminal (TTY). - [PERSISTENCE]: The instructions recommend using
setsid nohup ... & disownto run the login process in the background. This is a functional requirement to maintain the OAuth flow state across separate agent turns while waiting for human approval. - [DATA_EXPOSURE]: The skill uses fixed paths in the temporary directory (
/tmp/login.fifoand/tmp/login.log) to relay input and capture output, which may contain short-lived OAuth authorize URLs and redirect codes. While typical for local development utilities, this pattern can expose data to other local users on a multi-user system. The skill explicitly warns the agent to treat these as credentials.
Audit Metadata