T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:64- Finding
Coding Agents Are Launched with Safety and Approval Controls Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
Tmux
Security checks for vulnerabilities and agentic risk
Overview
The skill is a tmux helper, but it normalizes running coding agents with approval and permission safeguards disabled and ships a helper script with unsafe argument handling.
Review this skill carefully before installing. Its tmux functionality is legitimate, but do not use the documented `--dangerously-skip-permissions`, `--full-auto`, or `--yolo` examples unless you intentionally want unattended agent authority in an isolated worktree or sandbox. Treat the helper script as needing hardening before using it with untrusted or generated arguments.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wait-for-text.sh:26- Finding
Unvalidated Timeout Values Reach Bash Arithmetic Evaluation
- Content
View full analysis
0 )) && (( now - start_epoch >= hard_timeout )); then echo "Hard timeout after ${hard_timeout}s waiting for: $pattern" >&2 exit 1 fi # Stale timeout — only fire if output hasn't changed if (( stale_timeout > 0 )) && (( now - last_change_epoch >= stale_timeout )); then echo "Stale timeout: no output change for ${stale_timeout}s waiting for: $pattern" >&2 exit 1 fi ``` ### Technical Analysis Bash arithmetic contexts do not enforce integer-only input merely because the variables are used with `(( ... ))`. Variable contents can be interpreted recursively as arithmetic syntax. Crafted arithmetic expressions can trigger additional expansion behavior, including command substitution in contexts such as malicious array subscript expressions. Because `-T` and `--stale` are copied directly from command-line arguments and subsequently referenced inside arithmetic evaluations, an attacker who can control those arguments may supply syntax rather than a plain integer. This creates a command-injection boundary instead of a simple numeric comparison. The same input-validation weakness also affects operational robustness for `--interval` and `--lines`: they are passed to `sleep` and tmux respectively without explicit format or range validation. The confirmed command-execution concern, however, is associated with the values evaluated by Bash arithmetic. ### Attack Path 1. An attacker gains the ability to infl ...[truncated 1059 chars]- Remediation
View remediation
&2 exit 1 } [[ "$stale_timeout" =~ ^[0-9]+$ ]] || { echo "stale timeout must be a non-negative integer" >&2 exit 1 } [[ "$lines" =~ ^[0-9]+$ ]] || { echo "lines must be a non-negative integer" >&2 exit 1 } [[ "$interval" =~ ^[0-9]+([.][0-9]+)?$ ]] || { echo "interval must be a non-negative number" >&2 exit 1 } ``` Additional hardening should include: 1. Enforce reasonable upper bounds to prevent excessive waits, history captures, or resource consumption. 2. Reject missing option values explicitly rather than relying on `${2-}`. 3. Convert validated decimal values using a controlled representation before arithmetic use if leading-zero behavior is not desired. 4. Add negative tests covering shell metacharacters, arithmetic expressions, array-subscript syntax, empty values, negative values, and extremely large numbers. 5. Keep every expansion quoted when passed to external commands, as the script already does for most arguments. ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly recommends launching an agent with
claude --dangerously-skip-permissions, which disables normal safety or approval checks, but provides no warning, guardrails, or requirement for explicit user consent. In a tmux automation skill, this is more dangerous because it enables unattended execution inside persistent sessions, making risky actions easier to trigger and harder for users to notice in real time.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs use of
codex --full-autofor non-interactive fixes without warning that autonomous mode can perform unattended edits or other actions. Because this skill is specifically designed to remote-control interactive CLIs through tmux, it lowers friction for running autonomous agents in the background and increases the chance of silent, unreviewed changes.- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
sh target="" pattern="" grep_flag="-E" hard_timeout=0 stale_timeout=300 interval=5 lines=1000
Static analysis
No suspicious patterns detected.