Tmux Remote Control

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:47 PM UTC
• Version: 1.0.0

Overview

This tmux skill is mostly coherent, but it normalizes launching autonomous coding agents with approval safeguards disabled and ships a shell helper with unsafe argument handling.

Install only if you are comfortable with a skill that may steer agents to run detached coding sessions. Avoid the documented bypass/full-auto flags unless you deliberately run inside a tightly scoped sandbox or throwaway worktree, and treat the bundled wait helper as needing numeric input validation before use in any automation path that could receive untrusted arguments.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:24
• Finding: Coding Agents Are Launched with Permission and Approval Safeguards Disabled<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24-28, 64-66, and 85 **Vulnerability Type**: Unsafe permission bypass for autonomous coding agents **Risk Level**: High ### Vulnerable Code ```bash SESSION=oc-myproject-feature tmux new-session -d -s "$SESSION" -c ~/projects/myproject tmux send-keys -t "$SESSION" 'claude --dangerously-skip-permissions' Enter tmux capture-pane -p -J -t "$SESSION" -S -200 ``` The parallel-agent example repeats the unsafe configuration: ```bash # Launch agents tmux send-keys -t oc-project-fix1 'claude --dangerously-skip-permissions' Enter tmux send-keys -t oc-project-fix2 'codex --full-auto' Enter ``` The accompanying guidance also recommends bypass modes: ```text - Codex needs `--yolo` or `--full-auto` for non-interactive fixes ``` ### Technical Analysis The Skill presents agent modes that bypass normal permission prompts or approval controls as the standard workflow. The `--dangerously-skip-permissions`, `--full-auto`, and recommended `--yolo` options allow generated actions to proceed with substantially reduced human review. These options do not independently grant operating-system privileges beyond those of the user running the agent. However, they remove an important least-privilege and consent boundary between model-generated instructions and local command execution. This is particularly dangerous when an agent processes untrusted repositories, issue descriptions, source comments, build scripts, or other attacker-controlled content. An attacker can place instructions or deceptive task content in a repository and rely on the autonomous agent to execute commands without an approval checkpoint. The commands would run with all filesystem, process, repository, credential, and network access already available to the agent process. ### Attack Path 1. A victim opens or clones a repository containing attacker-controlled instructions, source comments, configuration, or build behavior. 2. The Skill star ...[truncated 1373 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--dangerously-skip-permissions`, `--full-auto`, and `--yolo` from the default examples and recommendations. 2. Launch coding agents in their normal interactive approval mode by default. 3. Require explicit, task-specific user consent before enabling any unattended execution mode. 4. If autonomous operation is necessary, run the agent inside a restricted container or sandbox with: - A dedicated unprivileged user. - A narrowly scoped writable working directory. - No access to SSH keys, cloud credentials, browser profiles, or unrelated home-directory files. - Network access disabled or restricted to an allowlist. - Read-only mounts for files that do not need modification. 5. Treat repository content and task descriptions as untrusted input. 6. Require review of generated commands and diffs before commits, pushes, package installation, or execution of repository scripts. 7. Document the security implications of bypass modes instead of presenting them as a routine requirement. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wait-for-text.sh:29
• Finding: Unvalidated Timeout Arguments Permit Bash Arithmetic Expression Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wait-for-text.sh`, lines 29-32 and 64-73 **Vulnerability Type**: Bash arithmetic expression injection **Risk Level**: High ### Vulnerable Code User-controlled command-line arguments are accepted without numeric validation: ```bash -T|--timeout) hard_timeout="${2-}"; shift 2 ;; --stale) stale_timeout="${2-}"; shift 2 ;; -i|--interval) interval="${2-}"; shift 2 ;; -l|--lines) lines="${2-}"; shift 2 ;; ``` The timeout values are subsequently evaluated as Bash arithmetic expressions: ```bash # Hard timeout (if set) if (( hard_timeout > 0 )) && (( now - start_epoch >= hard_timeout )); then echo "Hard timeout after ${hard_timeout}s waiting for: $pattern" >&2 exit 1 fi # Stale timeout — only fire if output hasn't changed if (( stale_timeout > 0 )) && (( now - last_change_epoch >= stale_timeout )); then echo "Stale timeout: no output change for ${stale_timeout}s waiting for: $pattern" >&2 exit 1 fi ``` ### Technical Analysis The values supplied through `-T`/`--timeout` and `--stale` are stored directly in variables and then referenced inside Bash arithmetic contexts using `(( ... ))`. Bash arithmetic evaluation does not restrict variable contents to decimal integers. Variable values can be recursively interpreted as arithmetic expressions. Crafted expressions involving variable or array references can cause additional shell expansion during arithmetic evaluation, including command substitution in applicable array-index expressions. Quoting the original command-line argument does not make it safe for later arithmetic evaluation. The vulnerability occurs when Bash interprets the stored string as an expression, rather than during initial argument assignment. The `interval` and `lines` parameters are also insufficiently validated. Although they are not used in the same arithmetic comparisons shown above, malformed values can disrupt `sleep` or alter arguments supplied to `tmux`. ...[truncated 1902 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Validate every numeric option immediately after argument parsing and before any arithmetic evaluation or command invocation. For integer-only timeout and line-count parameters: ```bash [[ "$hard_timeout" =~ ^[0-9]+$ ]] || { echo "Invalid hard timeout" >&2; exit 1; } [[ "$stale_timeout" =~ ^[0-9]+$ ]] || { echo "Invalid stale timeout" >&2; exit 1; } [[ "$lines" =~ ^[1-9][0-9]*$ ]] || { echo "Invalid line count" >&2; exit 1; } ``` If fractional polling intervals are required, validate them separately: ```bash [[ "$interval" =~ ^([0-9]+)(\.[0-9]+)?$ ]] || { echo "Invalid polling interval" >&2; exit 1; } ``` Additional hardening should include: 1. Enforce reasonable upper and lower bounds for all numeric parameters. 2. Reject missing option values explicitly instead of accepting `${2-}`. 3. Convert validated values using a controlled base where appropriate, such as `10#$value`, to prevent octal interpretation. 4. Add regression tests using arithmetic metacharacters, variable references, array expressions, command substitutions, negative values, and oversized numbers. 5. Keep all external-command arguments quoted, while recognizing that quoting alone does not protect values later interpreted by Bash arithmetic syntax. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The tmux skill’s stated purpose is terminal multiplexing and pane control, but the quickstart explicitly instructs launching a downstream coding agent with a permission-bypassing flag. That expands the skill into enabling unsandboxed autonomous actions without any safety framing, increasing the chance that users or higher-level agents invoke powerful tooling in a way that can modify files or systems without review.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation shows launching `claude --dangerously-skip-permissions` with no warning that this disables important safety checks and may allow code execution or file modifications without interactive approval. Omitting that warning is dangerous because the example appears in a quickstart section, making unsafe operation look like the recommended default.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The orchestration section goes beyond managing tmux sessions and actively promotes parallel execution of multiple coding agents, including polling for completion and collecting outputs. In context, this skill becomes an automation wrapper for scaling autonomous agent activity, which materially raises the blast radius of mistakes or misuse because multiple sessions can make concurrent changes across worktrees.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The parallel orchestration example uses fully autonomous flags like `--full-auto` without any caution about potential code changes, command execution, or system impact across multiple sessions. Because the example normalizes running several agents at once, the absence of warnings amplifies operational risk and can lead to broad unintended modifications.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

target=""
pattern=""
grep_flag="-E"
hard_timeout=0
stale_timeout=300
interval=5
lines=1000

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Static analysis

No suspicious patterns detected.