Security audit

BMAD Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent BMAD automation purpose, but it asks an agent to run broad remote code automation with permission checks disabled and weak cleanup/control safeguards.

Review this skill carefully before installing. It is not clearly malicious, but it is designed to drive a remote coding agent that can change code and commit work while bypassing normal permission prompts. Use it only in an isolated dev VM with a dedicated low-privilege account, pinned tool versions, explicit approval checkpoints, validated paths/session names, and a monitor cleanup plan.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/tmux-setup.md:14
Finding: Claude Code Is Launched with Permission Enforcement Disabled
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/tmux-setup.md:14
Finding: Unpinned Third-Party Package Is Retrieved and Executed Through npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/tmux-setup.md:3
Finding: Unquoted State Values Are Interpolated into Local and Remote Shell Commands
Content: View full analysis
" PROJECT_PATH="/mnt/nas/project/" # Create socket dir and session ssh ${VM_USER}@${VM_HOST} "mkdir -p /tmp/openclaw-tmux-sockets && tmux -S ${SOCKET} new -d -s ${SESSION} -n shell -c ${PROJECT_PATH}" ``` The same unsafe construction pattern appears in other commands, including: ```bash scp /tmp/prompt.txt ${VM_USER}@${VM_HOST}:/tmp/prompt.txt ssh ${VM_USER}@${VM_HOST} "tmux -S ${SOCKET} send-keys -t ${SESSION}:0.0 -l -- \"\$(cat /tmp/prompt.txt)\"" ``` ### Technical Analysis Host, username, socket path, session name, and project path values are expanded without robust validation and shell-safe argument handling. Several values are embedded into a quoted command string that is subsequently interpreted by a shell on the remote host. The state model in `SKILL.md` includes configurable `vm_host`, `vm_user`, `project_path`, and `tmux_session` fields. If any corresponding shell variable contains whitespace, shell metacharacters, command substitutions, or option-like values, the local or remote command can be changed from its intended meaning. Nested shell parsing makes ordinary quoting error-prone: the local shell first expands variables while the remote shell then interprets the resulting command text. ### Attack Path 1. An attacker influences a project name, project path, session value, host value, username, or persisted orchestrator state. 2. The malicious value contains shell syntax such as a command separator or command substitution. 3. The value is interpolated into the SSH or SCP command without strict validation or safe positional argument passing. 4. The local shell or the remote login shell interprets the injected syntax. 5. T ...[truncated 558 chars]
Remediation: View remediation

T06 · System Persistence

Warning

Location: SKILL.md:158
Finding: Workflow Installs a Recurring Cron Monitor Without Guaranteed Cleanup
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documented command starts Claude Code with --dangerously-skip-permissions, explicitly disabling safety and permission checks for an agent that is then remotely driven through tmux over SSH. In this skill's context, that gives the automated workflow unrestricted ability to execute impactful actions on the target host and project files, greatly increasing the blast radius of prompt injection, operator mistakes, or malicious task content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to drive Claude Code through tmux for sprint planning, story development, code review, retries, commits, and cron-based monitoring, but it does not require an explicit confirmation gate before system-modifying actions occur. In an agent setting, this can lead to unintended code changes, commits, automation setup, or repeated command execution on a dev VM without the user clearly consenting to each operational step.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions not only launch Claude Code in an unsafe mode but also automate selecting the permission-acceptance option via tmux keystrokes, removing human verification from sensitive actions. In an orchestration skill whose purpose is to manage implementation workflows, this makes dangerous behavior more likely because arbitrary generated actions can proceed without review while interacting with real project infrastructure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill launches Claude Code via npx @anthropic-ai/claude-code without pinning an exact version, which means each run may fetch whatever package version is current at execution time. In an automation workflow that also grants broad terminal control, this creates a supply-chain risk: unexpected upstream changes or a compromised release could execute with the same privileges as the orchestrated session.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.