Tmux Remote Control

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:47 PM UTC
• Version: 1.0.0

Overview

This tmux skill is mostly coherent, but it normalizes launching autonomous coding agents with approval safeguards disabled and ships a shell helper with unsafe argument handling.

Install only if you are comfortable with a skill that may steer agents to run detached coding sessions. Avoid the documented bypass/full-auto flags unless you deliberately run inside a tightly scoped sandbox or throwaway worktree, and treat the bundled wait helper as needing numeric input validation before use in any automation path that could receive untrusted arguments.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:24

Finding

Coding Agents Are Launched with Permission and Approval Safeguards Disabled

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wait-for-text.sh:29

Finding

Unvalidated Timeout Arguments Permit Bash Arithmetic Expression Injection

Content

View full analysis

0 )) && (( now - start_epoch >= hard_timeout )); then echo "Hard timeout after ${hard_timeout}s waiting for: $pattern" >&2 exit 1 fi # Stale timeout — only fire if output hasn't changed if (( stale_timeout > 0 )) && (( now - last_change_epoch >= stale_timeout )); then echo "Stale timeout: no output change for ${stale_timeout}s waiting for: $pattern" >&2 exit 1 fi ``` ### Technical Analysis The values supplied through `-T`/`--timeout` and `--stale` are stored directly in variables and then referenced inside Bash arithmetic contexts using `(( ... ))`. Bash arithmetic evaluation does not restrict variable contents to decimal integers. Variable values can be recursively interpreted as arithmetic expressions. Crafted expressions involving variable or array references can cause additional shell expansion during arithmetic evaluation, including command substitution in applicable array-index expressions. Quoting the original command-line argument does not make it safe for later arithmetic evaluation. The vulnerability occurs when Bash interprets the stored string as an expression, rather than during initial argument assignment. The `interval` and `lines` parameters are also insufficiently validated. Although they are not used in the same arithmetic comparisons shown above, malformed values can disrupt `sleep` or alter arguments supplied to `tmux`. ...[truncated 1902 chars]

Remediation

View remediation

&2; exit 1; } [[ "$stale_timeout" =~ ^[0-9]+$ ]] || { echo "Invalid stale timeout" >&2; exit 1; } [[ "$lines" =~ ^[1-9][0-9]*$ ]] || { echo "Invalid line count" >&2; exit 1; } ``` If fractional polling intervals are required, validate them separately: ```bash [[ "$interval" =~ ^([0-9]+)(\.[0-9]+)?$ ]] || { echo "Invalid polling interval" >&2; exit 1; } ``` Additional hardening should include: 1. Enforce reasonable upper and lower bounds for all numeric parameters. 2. Reject missing option values explicitly instead of accepting `${2-}`. 3. Convert validated values using a controlled base where appropriate, such as `10#$value`, to prevent octal interpretation. 4. Add regression tests using arithmetic metacharacters, variable references, array expressions, command substitutions, negative values, and oversized numbers. 5. Keep all external-command arguments quoted, while recognizing that quoting alone does not protect values later interpreted by Bash arithmetic syntax. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The tmux skill’s stated purpose is terminal multiplexing and pane control, but the quickstart explicitly instructs launching a downstream coding agent with a permission-bypassing flag. That expands the skill into enabling unsandboxed autonomous actions without any safety framing, increasing the chance that users or higher-level agents invoke powerful tooling in a way that can modify files or systems without review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation shows launching claude --dangerously-skip-permissions with no warning that this disables important safety checks and may allow code execution or file modifications without interactive approval. Omitting that warning is dangerous because the example appears in a quickstart section, making unsafe operation look like the recommended default.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The orchestration section goes beyond managing tmux sessions and actively promotes parallel execution of multiple coding agents, including polling for completion and collecting outputs. In context, this skill becomes an automation wrapper for scaling autonomous agent activity, which materially raises the blast radius of mistakes or misuse because multiple sessions can make concurrent changes across worktrees.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The parallel orchestration example uses fully autonomous flags like --full-auto without any caution about potential code changes, command execution, or system impact across multiple sessions. Because the example normalizes running several agents at once, the absence of warnings amplifies operational risk and can lead to broad unintended modifications.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/wait-for-text.sh (reported line 20)May include surrounding context.

sh

target=""
pattern=""
grep_flag="-E"
hard_timeout=0
stale_timeout=300
interval=5
lines=1000

Static analysis

No suspicious patterns detected.