TUI Puppeteering with tmux
An agent skill by tilework-tech, from tilework-tech/nori-skillsets. Tags: automation, cli, debugging, developer-tools, testing, validation.
What it does
Use when automating or testing TUI/CLI applications - provides isolated tmux sessions with scripts for input, output capture, and state verification
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add tilework-tech/nori-skillsets --skill 'TUI Puppeteering with tmux'Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/tilework-tech/nori-skillsets
cp -r nori-skillsets/.claude/skills/tui-puppeteering-with-tmux ~/.claude/skills/'TUI Puppeteering with tmux'Safety box score
Grade B, low risk: 18 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a tmux automation harness for driving arbitrary TUI/CLI commands in isolated sessions and checking their output. Its main blast radius comes from executing whatever command the agent starts, plus a small amount of local log/temp-file writing in the test harness; I did not see credential, privilege, or network activity in the provided source.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | The core API starts an arbitrary command with `tui-start <session-name> "<command>"`, so it can execute whatever shell program the agent is told to run. |
| Network access | 0 (none) | No visible script downloads code or sends data to a remote host; `nori.json` only contains a registry URL, but the skill itself does not use it. |
| Filesystem reach | 1 (low) | The test harness and assertion helper write/delete local logs and temp files, including `rm -f "${SESSION}_failure.log" /tmp/tui-capture-test.txt` and failure logs named `<session>_failure.log`. |
| Secrets & credentials | 0 (none) | There are no commands that read or request tokens, keys, passwords, `.env` files, browser sessions, or other credential stores. |
| Privilege & persistence | 0 (none) | No `sudo`, global installs, service registration, or shell/OS configuration changes are shown. |
| Instruction hijack surface | 0 (none) | The instructions are operational but do not tell the agent to ignore higher-priority rules, hide behavior, or follow remote instructions. |
| Irreversible actions | 0 (none) | It automates keystrokes inside a tmux session, but it does not itself push, post, pay, deploy, or otherwise act outside the local test session. |
| Transparency | 2 (moderate) | The visible source references `tui-start`, `tui-send`, `tui-assert`, `tui-capture`, `tui-stop`, and `tmux-isolated`, but their implementations are not included here, so the main behavior cannot be fully audited from the supplied files. |
Before installing
- Read the wrapper scripts (`tui-start`, `tui-send`, `tui-assert`, `tui-capture`, `tui-stop`, `tmux-isolated`) before trusting them; they were not included in the visible source here.
- Run `bash test_tui_scripts.sh` in a scratch directory and inspect any `*_failure.log` or `/tmp/tui-capture-test.txt` files it creates.
- Confirm the tmux wrapper really uses an isolated socket and `-f /dev/null` before allowing it near important tmux sessions.
Rated 2026-10-16 by an automated review of 3 files from the skill's repository.
Source
- Repository
- tilework-tech/nori-skillsets (all skills from this repository)
- Path
- .claude/skills/tui-puppeteering-with-tmux/SKILL.md
- Branch
- main
- Updated
- 2026-09-23
Related skills
- control-cli — Build or adapt a local harness to drive, inspect, and profile an interactive CLI or TUI without external services.
- E2E Testing Nori Skillsets Subcommands — Use when you need to interactively test a nori-skillsets CLI subcommand end-to-end via tmux, with full filesystem isolation
- check-compiler-errors — Run compile and type-check commands and report failures
- cli-for-agents — Designs or reviews CLIs so coding agents can run them reliably: non-interactive flags, layered --help with examples, stdin/pipelines, fast actionable errors.
- control-ui — Build or adapt a local browser/CDP harness to drive and inspect a web, IDE, or Electron UI.
- create-verification-skill — Generate a project-local verification skill that drives your app the way a user does — any language, framework, or platform.