ClawHub
Back to skill

Security audit

Tmux Steipete

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent tmux-control helper, but it encourages unattended parallel coding-agent execution with reduced approval safeguards and gives destructive cleanup commands without enough warning.

Install only if you are comfortable with a skill that can drive tmux sessions and capture their output. Avoid the documented `--yolo` and `--full-auto` examples unless you are using isolated worktrees or disposable environments and will review all changes afterward. Be careful with the cleanup commands because they can terminate active tmux jobs.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:74
Finding

Unrestricted Coding-Agent Execution Disables Approval Safeguards

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 74-92
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Vulnerable Code:

bash
# Launch agents in different workdirs
tmux -S "$SOCKET" send-keys -t agent-1 "cd /tmp/project1 && codex --yolo 'Fix bug X'" Enter
tmux -S "$SOCKET" send-keys -t agent-2 "cd /tmp/project2 && codex --yolo 'Fix bug Y'" Enter

# Poll for completion (check if prompt returned)
for sess in agent-1 agent-2; do
  if tmux -S "$SOCKET" capture-pane -p -t "$sess" -S -3 | grep -q "❯"; then
    echo "$sess: DONE"
  else
    echo "$sess: Running..."
  fi
done

# Get full output from completed session
tmux -S "$SOCKET" capture-pane -p -t agent-1 -S -500
text
Codex needs `--yolo` or `--full-auto` for non-interactive fixes

Technical Analysis

The documented orchestration procedure starts Codex with the --yolo option and additionally recommends --yolo or --full-auto for non-interactive operation. These modes disable or substantially weaken interactive approval controls, allowing the nested coding agent to execute commands and modify files without case-by-case user authorization.

This exceeds the privileges required for the Skill's legitimate purpose of creating and controlling tmux sessions. The tmux commands themselves are not malicious, but they provide an execution channel for an agent operating with reduced safeguards. If the target project contains attacker-controlled instructions, scripts, build hooks, or other hostile content, the unrestricted agent may act on that content under the invoking user's operating-system permissions.

Attack Path

  1. A victim follows the documented example and opens a project containing attacker-controlled content.
  2. The victim launches Codex inside tmux with --yolo or --full-auto.
  3. Codex processes the repository, task instructions, build files, o ...[truncated 1140 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove --yolo and --full-auto from the examples and do not recommend globally disabling approval safeguards.
  2. Use an execution mode that requires explicit approval for shell commands, filesystem writes, dependency installation, network access, and other sensitive operations.
  3. Run coding agents in an isolated container or sandbox with a narrowly mounted working directory, a non-privileged user, and no access to unrelated home-directory files.
  4. Remove unnecessary environment variables and credentials before launching the agent. Provide only task-specific secrets when strictly required.
  5. Disable network access by default or restrict it to an explicit allowlist.
  6. Review repository instructions, build hooks, dependency manifests, and executable scripts before permitting automated execution.
  7. If unattended automation is necessary, define explicit command, path, and network allowlists rather than disabling authorization controls globally.
  8. Document the risks of processing untrusted repositories and require stronger isolation for third-party code.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description emphasizes remote control of tmux sessions for interactive CLI use, specifically sending keystrokes and scraping pane output. This code chunk does neither. It is a discovery/listing utility: it validates tmux availability, selects a socket or scans all sockets in a directory, runs tmux list-sessions, optionally filters names, and prints session metadata. While session discovery could support a broader tmux-control skill, this chunk’s actual behavior is materially different from the stated purpose and includes socket-directory scanning and metadata enumeration not reflected in the description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The examples encourage running coding agents with --yolo or --full-auto, which authorizes autonomous actions and code changes with reduced human review. In a tmux orchestration skill, this can amplify unsafe behavior across multiple parallel sessions, increasing the chance of unintended repository modification, command execution, or resource misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The cleanup section includes commands such as kill-session and kill-server that can terminate active interactive jobs and destroy user state without any warning or confirmation. In a skill designed to control long-running tmux workflows, this creates a meaningful risk of accidental denial of service or data loss if an operator copies the commands blindly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.