Tmux Agents

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:28 AM UTC
• Version: 1.0.0

Overview

This skill is a legitimate tmux background-agent helper, but its default launcher gives coding agents unattended high-impact control and has unsafe shell input handling.

Review this carefully before installing. Use it only in disposable or tightly scoped workspaces, avoid passing untrusted task text, and prefer interactive agent modes unless you intentionally want unattended file edits and command execution. Be aware that Claude, Codex, and Gemini tasks may send prompts and code to cloud providers, and kill tmux sessions when finished.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/spawn.sh:44

Finding

Shell Command Injection Through Unescaped Task and Agent Arguments

Content

View full analysis

Remediation

View remediation

&2 exit 1 ;; esac ``` 2. Do not construct shell command strings from untrusted input. Launch the command through a wrapper that receives the task as a positional argument, or safely serialize every argument with `printf '%q'`. 3. If commands must be typed into a tmux shell, build them from a fixed executable and individually shell-escaped arguments: ```bash printf -v quoted_task '%q' "$TASK" tmux send-keys -t "$SESSION_NAME" \ "claude --dangerously-skip-permissions $quoted_task" Enter ``` 4. Apply the same encoding to text sent through diagnostic `echo` commands, or avoid shell interpretation by using `tmux display-message`. 5. Validate session names against a conservative allowlist, such as `^[A-Za-z0-9_-]+$`, and reject invalid values. 6. Add regression tests using payloads containing command substitutions, semicolons, quotes, redirections, newlines, and backticks. Verify that these values are delivered literally to the selected agent and never executed by the shell. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/spawn.sh:63

Finding

Unrestricted Agent Execution Bypasses Least-Privilege Controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · README.md (reported line 81)May include surrounding context.

bash

ollama pull glm-4.7-flash
ollama launch claude --model glm-4.7-flash --config
ollama launch codex --model glm-4.7-flash --config

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

bash

ollama pull glm-4.7-flash
ollama launch claude --model glm-4.7-flash --config
ollama launch codex --model glm-4.7-flash --config

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · README.md (reported line 82)May include surrounding context.

bash

ollama pull glm-4.7-flash
ollama launch claude --model glm-4.7-flash --config
ollama launch codex --model glm-4.7-flash --config

License

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

bash

ollama pull glm-4.7-flash
ollama launch claude --model glm-4.7-flash --config
ollama launch codex --model glm-4.7-flash --config

License

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script launches coding agents with dangerous non-interactive execution modes, including Claude's permission bypass and Codex full-auto editing. In the context of a tmux background-agent skill, this is especially risky because it encourages unattended operation, increasing the chance an agent can read, modify, or execute actions on the host without meaningful user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script enables auto-approved or permission-skipping modes without a clear runtime warning or consent gate, despite orchestrating external coding agents that may execute commands or edit files. Because the skill is designed for spawning background sessions, the lack of explicit safety prompts makes unattended misuse substantially more dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes use of cloud agents like Claude, Codex, and Gemini but does not warn users that task prompts and embedded code or secrets may be sent to third-party providers. In a tool specifically designed to run coding tasks in background sessions, users may submit sensitive repository contents or credentials without realizing the privacy and compliance implications.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 91% confidence

Finding

The trigger phrase 'run codex' overlaps with the generic built-in verb 'run', creating a shadowing/confusion risk where normal user requests may unintentionally activate this skill. Because the skill can lead to spawning persistent coding agents, ambiguous command routing could cause unexpected agent execution or workflow changes.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 91% confidence

Finding

The trigger phrase 'run gemini' has the same shadow-command problem as 'run codex', colliding with a common built-in action verb. This ambiguity can cause accidental skill activation and unintended background agent workflows when a user simply intends to run a model or command in another context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes broad phrases such as 'coding task', 'background task', and 'tmux session', which can cause the skill to activate in contexts where the user did not intend to invoke it. Unintended activation is risky here because the skill is designed to launch background agents and could steer users toward spawning external or local coding agents without a clear, explicit request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises cloud agents but does not warn that prompts, code, or task details may be transmitted to third-party services. Users may unknowingly expose proprietary source code, credentials, or sensitive project context when following the documented commands.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The 'auto-approve mode' language signals reduced human review for an autonomous coding agent. In the context of a tool that runs persistent background sessions, this increases the chance of unreviewed code changes, unsafe commands, or broader unintended modifications being accepted without adequate oversight.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

| Agent | Command | Best For |
|-------|---------|----------|
| **claude** | Claude Code | Complex coding, refactoring, full projects |
| **codex** | OpenAI Codex | Quick edits, auto-approve mode |
| **gemini** | Google Gemini | Research, analysis, documentation |

### 🦙 Local Agents (FREE via Ollama)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comments frame the behavior as merely launching agents, but the implementation silently enables permission bypass and full automation. That mismatch can mislead users into trusting the script more than they should, causing them to run highly privileged autonomous agents without understanding the operational risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

codex --auto-edit --full-auto delegates substantial decision-making and action-taking to the agent, allowing it to modify code and potentially run workflows without step-by-step approval. While autonomy is part of the tool's purpose, enabling it by default in a background tmux session materially increases the risk of unintended destructive changes or command execution.

Content

Scanner excerpt · scripts/spawn.sh (reported line 64)May include surrounding context.

sh

tmux send-keys -t "$SESSION_NAME" "claude --dangerously-skip-permissions \"$TASK\"" Enter
    ;;
  codex)
    # OpenAI Codex CLI with auto-approve (cloud)
    tmux send-keys -t "$SESSION_NAME" "codex --auto-edit --full-auto \"$TASK\"" Enter
    ;;
  gemini)

Static analysis

No suspicious patterns detected.