Security audit

Lucky Tmux Controller

Security checks for vulnerabilities and agentic risk

Overview

The skill openly enables tmux remote control, but it gives agents broad authority to read and manipulate existing interactive sessions with limited scoping or safety guardrails.

Install only if you intentionally want an agent to inspect and operate your tmux sessions. Use it with narrowly named targets, avoid running it against shared or sensitive sessions, and require explicit confirmation before approving prompts, sending interrupt/EOF keys, killing sessions, or dumping pane history.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description says the skill remotely controls tmux sessions for interactive CLIs by sending keystrokes and scraping pane output. The supplied code only discovers and lists tmux sessions, including support for selecting a tmux socket or scanning all sockets in a directory. That is a different primary behavior: session enumeration/inspection rather than interactive remote control. It also accesses socket directories on the filesystem, which is not reflected in the description. Because core advertised capabilities (sending keystrokes, scraping pane output) are absent and the actual implemented capability is materially different, this is a description/behavior mismatch.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guidance says the skill should not be used to create new tmux sessions, yet later documents commands to create, kill, and rename sessions. This inconsistency can mislead an agent into performing broader session-management actions than intended, including destructive actions like killing active sessions and interrupting running work.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This is a second manifestation of the same safety issue: the document forbids creating sessions in one section but later provides explicit instructions to do so. In an agent skill, contradictory operational guidance increases the risk of unauthorized or accidental environment changes because the agent may follow the more specific example over the earlier restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation includes control and destructive tmux operations such as sending Ctrl+C/Ctrl+D, killing sessions, and renaming sessions without warning about terminating processes, losing interactive state, or disrupting other users' work. In a remote-control skill, these omissions are dangerous because an agent can directly affect long-running sessions and interactive tools with a single command.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: On timeout, the script prints the full captured tmux pane contents to stderr. In this skill, tmux panes are used to drive interactive CLIs, which commonly display secrets, tokens, command output, file contents, or other sensitive data; a failed wait can therefore disclose unrelated pane history into logs or upstream callers. The behavior appears intended for debugging, but it creates a real information exposure risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.