Resilient Coding Agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:49 PM UTC
• Version: 0.5.0

Overview

The skill has a coherent purpose, but its tmux command examples create real command-injection risk while running powerful coding agents in long-lived sessions.

Review before installing. Use only with trusted project paths, avoid paths containing spaces or shell metacharacters, quote or pass the project directory through an environment variable before use, and delete the temp directory after collecting any needed logs. Be especially cautious because the examples run autonomous coding agents in long-lived tmux sessions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:53

Finding

Shell Command Injection Through an Unquoted Project Directory Placeholder

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:52-53, SKILL.md:72-73, SKILL.md:83-89, and SKILL.md:98-104
Vulnerability Type: Shell command injection
Risk Level: High

The affected instructions directly interpolate the <project-dir> placeholder into commands that are sent to a shell running inside tmux.

bash

tmux new-session -d -s codex-<task-name> -e "TASK_TMPDIR=$TMPDIR"
tmux send-keys -t codex-<task-name> 'cd <project-dir> && set -o pipefail && codex exec --full-auto --json "$(cat $TASK_TMPDIR/prompt)" | tee $TASK_TMPDIR/events.jsonl && echo "__TASK_DONE__"' Enter

bash

tmux new-session -d -s claude-<task-name> -e "TASK_TMPDIR=$TMPDIR"
tmux send-keys -t claude-<task-name> 'cd <project-dir> && claude -p "$(cat $TASK_TMPDIR/prompt)" && echo "__TASK_DONE__"' Enter

bash

# OpenCode
tmux new-session -d -s opencode-<task-name> -e "TASK_TMPDIR=$TMPDIR"
tmux send-keys -t opencode-<task-name> 'cd <project-dir> && opencode run "$(cat $TASK_TMPDIR/prompt)" && echo "__TASK_DONE__"' Enter

# Pi (separate temp dir)
TMPDIR=$(mktemp -d) && chmod 700 "$TMPDIR"
tmux new-session -d -s pi-<task-name> -e "TASK_TMPDIR=$TMPDIR"
tmux send-keys -t pi-<task-name> 'cd <project-dir> && pi -p "$(cat $TASK_TMPDIR/prompt)" && echo "__TASK_DONE__"' Enter

The optional completion-notification examples repeat the vulnerable construction:

bash

# Generic: touch a marker file
tmux send-keys -t codex-<task-name> 'cd <project-dir> && codex exec --full-auto "$(cat $TASK_TMPDIR/prompt)" && touch $TASK_TMPDIR/done; echo "__TASK_DONE__"' Enter

# macOS: system notification
tmux send-keys -t codex-<task-name> 'cd <project-dir> && codex exec --full-auto "$(cat $TASK_TMPDIR/prompt)" && osascr
...[truncated 3404 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not interpolate <project-dir> directly into shell command text.
2. Resolve the directory to an absolute path and verify that it exists and is a directory before creating the tmux session.
3. Pass the validated path through a dedicated tmux environment variable.
4. Quote that variable in the command interpreted by the pane's shell.
5. Use cd -- so paths beginning with a hyphen cannot be interpreted as options.
6. Quote all temporary-directory references for defense in depth.
7. Programmatically enforce the documented [a-z0-9-]+ restriction for task names.

A hardened Codex example is:

bash

PROJECT_DIR=$(cd -- "$PROJECT_DIR" && pwd -P) || exit 1
[ -d "$PROJECT_DIR" ] || exit 1

tmux new-session -d -s "codex-$TASK_NAME" \
  -e "TASK_TMPDIR=$TMPDIR" \
  -e "PROJECT_DIR=$PROJECT_DIR"

tmux send-keys -t "codex-$TASK_NAME" \
  'cd -- "$PROJECT_DIR" && set -o pipefail && codex exec --full-auto --json "$(cat "$TASK_TMPDIR/prompt")" | tee "$TASK_TMPDIR/events.jsonl" && echo "__TASK_DONE__"' Enter

Apply the same environment-variable and quoting pattern to the Claude Code, OpenCode, Pi, and completion-notification examples. Where supported, prefer launching the target process through an API that accepts an argument array and an explicit working directory rather than constructing shell command strings.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Prompt Exfiltration via Tool

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains patterns that exfiltrate system prompts or internal instructions via tool calls (file writes, network requests, logging).

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

TMPDIR=$(mktemp -d)
chmod 700 "$TMPDIR"

# Step 2: Write prompt to file (use orchestrator's write tool, not echo/shell)
# File: $TMPDIR/prompt

# Step 3: Launch in tmux (pass TMPDIR via env)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

**Prompt safety:** Task prompts are never interpolated into shell commands. Instead, write the prompt to a temp file using the orchestrator's `write` tool (no shell involved), then reference it with `"$(cat $TMPDIR/prompt)"` inside the tmux command. The shell treats command substitution output inside double quotes as a single literal argument, preventing injection. This depends on the orchestrator's `write` tool not invoking a shell; OpenClaw's built-in `write` tool meets this requirement.

**Sensitive output:** tmux scrollback and event log files may contain secrets or API keys from agent output. On shared machines, restrict file permissions (`chmod 600`) and clean up temp directories after task completion.

## Prerequisites

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

bash

# Step 1: Create secure temp directory
TMPDIR=$(mktemp -d)
chmod 700 "$TMPDIR"

# Step 2: Write prompt to file (use orchestrator's write tool, not echo/shell)
# File: $TMPDIR/prompt

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

bash

# Step 1: Create secure temp directory
TMPDIR=$(mktemp -d)
chmod 700 "$TMPDIR"

# Step 2: Write prompt to file (use orchestrator's write tool, not echo/shell)
# File: $TMPDIR/prompt

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash

# Step 1: Create secure temp directory
TMPDIR=$(mktemp -d)
chmod 700 "$TMPDIR"

# Step 2: Write prompt to file (use orchestrator's write tool, not echo/shell)
# File: $TMPDIR/prompt

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

bash

# Step 1: Create secure temp directory
TMPDIR=$(mktemp -d)
chmod 700 "$TMPDIR"

# Step 2: Write prompt to file (use orchestrator's write tool, not echo/shell)
# File: $TMPDIR/prompt

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly notes that tmux scrollback and event logs may contain secrets, but the cleanup section only kills the tmux session and does not instruct operators to securely remove the per-task temp directory and its files. This can leave prompts, session IDs, done markers, and captured agent output on disk after completion, increasing the chance of later disclosure on shared or multi-user systems.

Content

No source excerpt is available for this finding.