opentui
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Scaffolding and project initialization instructions rely on executing remote tools from a package registry.\n
- Evidence: The documentation recommends using
bunx create-tui@latestfor project creation inreferences/core/REFERENCE.md,references/react/REFERENCE.md, andreferences/solid/REFERENCE.md.\n- [INDIRECT_PROMPT_INJECTION]: The platform processes untrusted data via input components and content parsers, creating a surface for potential injection attacks.\n - Evidence: Ingestion points include
<input>,<textarea>, andusePastehandlers documented inreferences/components/inputs.mdandreferences/keyboard/REFERENCE.md.\n - Evidence: The
MarkdownRenderablecomponent parses external content as described inreferences/components/code-diff.md.\n- [DATA_EXFILTRATION]: Diagnostic features in the platform allow for the logging of terminal interactions, which may capture sensitive information.\n - Evidence: The
OTUI_STDIN_LOGenvironment variable, detailed inreferences/core/configuration.md, enables logging of raw terminal input bytes to a specified file, which the documentation notes may contain secrets.
Audit Metadata