Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs before they execute.
Tirith is a terminal security tool that intercepts commands, pasted content, and scanned files to detect deceptive URLs, hidden or obfuscated payloads, credential theft, malicious agent skills, and known-bad packages or network indicators before execution. It is for developers and AI agents that run shell commands or install software. Its catalogue entries configure or extend protection through a shell hook, skill, and setting.
This repository also configures its own agents. See what tirith tells them →
Skill Claude CodeCodex
Terminal security analysis for shell environments. This skill should be used when checking commands for supply-chain attacks before execution, scanning repositories for hidden content or config poisoning, scoring URLs for homograph attacks, setting up AI tool protection, inspecting Python package artifacts, governing…