Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed TUI automation guide, but it broadly enables a daemon-backed tool to drive editors and shells, so users should review its scope before installing.
Install only if you want an agent to operate local terminal programs through tui-agent. Use it with explicit user direction for the target program and file paths, review changes before saving files, prefer normal scoped tools for simple shell commands, and stop tui-agent sessions when finished.
The skill activation criteria are extremely broad, covering nearly any request involving terminal programs, editors, monitors, file managers, or shell-like automation. This increases the chance the agent will invoke a high-capability skill in situations where safer, narrower tools would suffice, leading to unintended command execution or file/system modification.
The documentation gives concrete workflows for editing and saving files in nano and vim but does not warn that these actions persist changes to user files. In an agent setting, such examples normalize state-changing behavior and can cause silent file modification if the skill is invoked without explicit user confirmation or path validation.
The skill explicitly demonstrates starting an interactive bash session and sending shell commands, but it lacks warnings about executing arbitrary commands with system impact. In context, tui-agent acts as a keyboard-and-screen bridge to a live shell, so broad activation plus shell automation materially raises the risk of destructive commands, data access, or unintended environment changes.
No suspicious patterns detected.
