Is @arbidocs/tui safe?

The component can run operating-system commands or spawn processes.

var child_process = require('child_process');

const child = child_process.spawnSync(editor, [path$1], { stdio: "inherit" });

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

The component reads files from disk.

return fs.readFileSync(path$1, "utf8");

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component writes or deletes files on disk.

fs.writeFileSync(path$1, original, "utf8");

fs.rmSync(dir, { recursive: true, force: true });

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.