Resilient Coding Agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:49 PM UTC
• Version: 0.5.0

Overview

The skill has a coherent purpose, but its tmux command examples create real command-injection risk while running powerful coding agents in long-lived sessions.

Review before installing. Use only with trusted project paths, avoid paths containing spaces or shell metacharacters, quote or pass the project directory through an environment variable before use, and delete the temp directory after collecting any needed logs. Be especially cautious because the examples run autonomous coding agents in long-lived tmux sessions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:53
• Finding: Shell Command Injection Through an Unquoted Project Directory Placeholder## Vulnerability Details **File Location**: `SKILL.md:52-53`, `SKILL.md:72-73`, `SKILL.md:83-89`, and `SKILL.md:98-104` **Vulnerability Type**: Shell command injection **Risk Level**: High The affected instructions directly interpolate the `<project-dir>` placeholder into commands that are sent to a shell running inside tmux. ```bash tmux new-session -d -s codex-<task-name> -e "TASK_TMPDIR=$TMPDIR" tmux send-keys -t codex-<task-name> 'cd <project-dir> && set -o pipefail && codex exec --full-auto --json "$(cat $TASK_TMPDIR/prompt)" | tee $TASK_TMPDIR/events.jsonl && echo "__TASK_DONE__"' Enter ``` ```bash tmux new-session -d -s claude-<task-name> -e "TASK_TMPDIR=$TMPDIR" tmux send-keys -t claude-<task-name> 'cd <project-dir> && claude -p "$(cat $TASK_TMPDIR/prompt)" && echo "__TASK_DONE__"' Enter ``` ```bash # OpenCode tmux new-session -d -s opencode-<task-name> -e "TASK_TMPDIR=$TMPDIR" tmux send-keys -t opencode-<task-name> 'cd <project-dir> && opencode run "$(cat $TASK_TMPDIR/prompt)" && echo "__TASK_DONE__"' Enter # Pi (separate temp dir) TMPDIR=$(mktemp -d) && chmod 700 "$TMPDIR" tmux new-session -d -s pi-<task-name> -e "TASK_TMPDIR=$TMPDIR" tmux send-keys -t pi-<task-name> 'cd <project-dir> && pi -p "$(cat $TASK_TMPDIR/prompt)" && echo "__TASK_DONE__"' Enter ``` The optional completion-notification examples repeat the vulnerable construction: ```bash # Generic: touch a marker file tmux send-keys -t codex-<task-name> 'cd <project-dir> && codex exec --full-auto "$(cat $TASK_TMPDIR/prompt)" && touch $TASK_TMPDIR/done; echo "__TASK_DONE__"' Enter # macOS: system notification tmux send-keys -t codex-<task-name> 'cd <project-dir> && codex exec --full-auto "$(cat $TASK_TMPDIR/prompt)" && osascr ...[truncated 3404 chars]
• Remediation: ## Remediation Suggestions 1. Do not interpolate `<project-dir>` directly into shell command text. 2. Resolve the directory to an absolute path and verify that it exists and is a directory before creating the tmux session. 3. Pass the validated path through a dedicated tmux environment variable. 4. Quote that variable in the command interpreted by the pane's shell. 5. Use `cd --` so paths beginning with a hyphen cannot be interpreted as options. 6. Quote all temporary-directory references for defense in depth. 7. Programmatically enforce the documented `[a-z0-9-]+` restriction for task names. A hardened Codex example is: ```bash PROJECT_DIR=$(cd -- "$PROJECT_DIR" && pwd -P) || exit 1 [ -d "$PROJECT_DIR" ] || exit 1 tmux new-session -d -s "codex-$TASK_NAME" \ -e "TASK_TMPDIR=$TMPDIR" \ -e "PROJECT_DIR=$PROJECT_DIR" tmux send-keys -t "codex-$TASK_NAME" \ 'cd -- "$PROJECT_DIR" && set -o pipefail && codex exec --full-auto --json "$(cat "$TASK_TMPDIR/prompt")" | tee "$TASK_TMPDIR/events.jsonl" && echo "__TASK_DONE__"' Enter ``` Apply the same environment-variable and quoting pattern to the Claude Code, OpenCode, Pi, and completion-notification examples. Where supported, prefer launching the target process through an API that accepts an argument array and an explicit working directory rather than constructing shell command strings.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Prompt Exfiltration via Tool

High

• Category: System Prompt Leakage

Content

TMPDIR=$(mktemp -d)
chmod 700 "$TMPDIR"

# Step 2: Write prompt to file (use orchestrator's write tool, not echo/shell)
# File: $TMPDIR/prompt

# Step 3: Launch in tmux (pass TMPDIR via env)

• Confidence: 85% confidence
• Finding: Skill contains patterns that exfiltrate system prompts or internal instructions via tool calls (file writes, network requests, logging).

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Prompt safety:** Task prompts are never interpolated into shell commands. Instead, write the prompt to a temp file using the orchestrator's `write` tool (no shell involved), then reference it with `"$(cat $TMPDIR/prompt)"` inside the tmux command. The shell treats command substitution output inside double quotes as a single literal argument, preventing injection. This depends on the orchestrator's `write` tool not invoking a shell; OpenClaw's built-in `write` tool meets this requirement.

**Sensitive output:** tmux scrollback and event log files may contain secrets or API keys from agent output. On shared machines, restrict file permissions (`chmod 600`) and clean up temp directories after task completion.

## Prerequisites

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Step 1: Create secure temp directory
TMPDIR=$(mktemp -d)
chmod 700 "$TMPDIR"

# Step 2: Write prompt to file (use orchestrator's write tool, not echo/shell)
# File: $TMPDIR/prompt

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Step 1: Create secure temp directory
TMPDIR=$(mktemp -d)
chmod 700 "$TMPDIR"

# Step 2: Write prompt to file (use orchestrator's write tool, not echo/shell)
# File: $TMPDIR/prompt

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Step 1: Create secure temp directory
TMPDIR=$(mktemp -d)
chmod 700 "$TMPDIR"

# Step 2: Write prompt to file (use orchestrator's write tool, not echo/shell)
# File: $TMPDIR/prompt

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Step 1: Create secure temp directory
TMPDIR=$(mktemp -d)
chmod 700 "$TMPDIR"

# Step 2: Write prompt to file (use orchestrator's write tool, not echo/shell)
# File: $TMPDIR/prompt

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill explicitly notes that tmux scrollback and event logs may contain secrets, but the cleanup section only kills the tmux session and does not instruct operators to securely remove the per-task temp directory and its files. This can leave prompts, session IDs, done markers, and captured agent output on disk after completion, increasing the chance of later disclosure on shared or multi-user systems.