textual-tui

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The scripts scripts/dump_dom_and_bindings.py and scripts/generate_pilot_tests.py dynamically load and execute local Python modules using importlib and exec_module to perform runtime analysis of Textual applications based on paths provided as CLI arguments.
  • [COMMAND_EXECUTION]: The scripts/self_check.py utility invokes subprocess.run to execute other scripts within the package to validate the integrity of the application templates.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes and executes local project code for auditing purposes, creating a vulnerability surface where maliciously crafted application files could influence the agent's analysis output. Ingestion points: Local project files (Python, TCSS) are read in scripts/audit_textual_project.py and scripts/inspect_textual_project.py via Path.read_text. Boundary markers: None present to distinguish untrusted data from instructions. Capability inventory: File system write access, subprocess execution, and dynamic Python code loading. Sanitization: None.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 05:13 PM