nethack-mcp

The project uses standard operating system commands (`tmux`, `nethack`) and executes them via Go's `os/exec` package. Inputs for `tmux` commands are either hardcoded, derived from environment variables, or passed as distinct arguments, reducing the risk of shell injection. The `NETHACK_TMUX_SESSION` environment variable is a potential point of concern if its value could be maliciously crafted, but `tmux` command arguments like session names are generally not exploitable in this context. There are no network services exposed or arbitrary `eval` like constructs observed. The system is designed for a trusted local agent environment.