ClawHub
Back to skill

Security audit

Tmux

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent tmux automation helper, but it recommends unattended high-authority coding-agent execution and can print captured terminal contents into logs on timeout.

Install only if you are comfortable with a tmux helper that can drive interactive sessions and read pane output. Avoid using the documented `--yolo` or `--full-auto` examples except in isolated worktrees or sandboxes, and be careful using `wait-for-text.sh` around panes that may contain tokens, credentials, private source, or other sensitive output because timeouts print pane history to stderr.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:80
Finding

Approval Bypass Recommended for Autonomous Coding Agents

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 80-81 and 98
Vulnerability Type: Unsafe execution guidance that bypasses interactive approval controls
Risk Level: High

Vulnerable Code

bash
tmux -S "$SOCKET" send-keys -t agent-1 "cd /tmp/project1 && codex --yolo 'Fix bug X'" Enter
tmux -S "$SOCKET" send-keys -t agent-2 "cd /tmp/project2 && codex --yolo 'Fix bug Y'" Enter

The associated operational guidance states:

text
- Codex needs `--yolo` or `--full-auto` for non-interactive fixes

Technical Analysis

The Skill recommends launching coding agents with --yolo or --full-auto. These modes bypass or substantially reduce interactive approval checks for commands and file modifications generated by the coding agent.

Although tmux orchestration legitimately requires sending commands to interactive panes, disabling the downstream agent's approval boundary is not required for basic tmux control. The recommendation combines autonomous command generation with unattended execution, weakening least-privilege and human-review controls.

The risk becomes exploitable when the coding task, repository contents, retrieved instructions, or other context supplied to the coding agent is malicious or misleading. The coding agent may then execute commands or modify files without an operator reviewing each action.

Attack Path

  1. An operator follows the documented example and starts Codex with --yolo or --full-auto.
  2. The coding agent processes attacker-controlled or compromised input, such as a malicious task description or repository instructions.
  3. That input induces the agent to issue unsafe shell commands or make unauthorized file changes.
  4. Because approval controls have been disabled, the commands execute without interactive confirmation.
  5. The attacker-influenced operations affect files, processes, credentials, or other resources accessible to the account ...[truncated 667 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the recommendation to use --yolo or --full-auto.
  • Use an approval-gated execution mode in which shell commands and sensitive file modifications require explicit operator confirmation.
  • Run each coding agent in a restricted sandbox or container with only the required project directory mounted.
  • Apply operating-system-level least privilege and prevent access to unrelated repositories, user credentials, SSH keys, cloud credentials, and host control sockets.
  • Use separate, disposable worktrees and unprivileged accounts for parallel agents.
  • Require review of generated changes before merging or deploying them.
  • If unattended execution is operationally unavoidable, enforce command allowlists, filesystem boundaries, network restrictions, resource limits, and comprehensive audit logging.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/wait-for-text.sh:75
Finding

Sensitive Tmux Pane History Disclosed Through Timeout Logs

Content
View full analysis

Vulnerability Details

File Location: scripts/wait-for-text.sh, lines 75-79
Vulnerability Type: Sensitive information exposure through diagnostic output
Risk Level: Medium

Vulnerable Code

bash
if (( now >= deadline )); then
  echo "Timed out after ${timeout}s waiting for pattern: $pattern" >&2
  echo "Last ${lines} lines from $target:" >&2
  printf '%s\n' "$pane_text" >&2
  exit 1
fi

The disclosed value is populated from pane history earlier in the polling loop:

bash
pane_text="$(tmux capture-pane -p -J -t "$target" -S "-${lines}" 2>/dev/null || true)"

Technical Analysis

Whenever the requested text is not found before the timeout, the script writes the captured tmux pane history to standard error. The default configuration can expose the last 1,000 lines.

Interactive terminal history can contain access tokens, passwords entered into prompts, environment values, private source code, internal URLs, command arguments, error diagnostics, and output from other tools. Standard error is frequently retained by CI systems, agent frameworks, shell wrappers, and centralized logging services.

The disclosure is automatic and does not require an explicit debug option. Consequently, an ordinary timeout converts transient pane contents into a potentially persistent and more broadly accessible log record.

Attack Path

  1. Sensitive information is displayed in the targeted tmux pane.
  2. The script is invoked with a pattern that is absent, incorrect, or intentionally chosen not to match.
  3. The script repeatedly captures up to the configured number of pane-history lines.
  4. The timeout expires.
  5. The script prints the captured pane contents to standard error.
  6. A CI runner, agent host, orchestration framework, or logging service retains that output.
  7. A user or service with access to those logs can retrieve the exposed terminal data.

Impact As

...[truncated 521 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not print captured pane contents on timeout by default.
  • Add an explicit opt-in diagnostic option, such as --show-pane-on-timeout.
  • Print only a minimal status message containing the target and timeout duration under normal operation.
  • When diagnostics are enabled, impose a small maximum output size and redact likely passwords, tokens, authorization headers, private keys, and credential-bearing URLs.
  • Warn users that diagnostic output may contain sensitive terminal data.
  • Avoid including the search pattern in logs when it may itself contain sensitive data.
  • Configure CI and orchestration systems to restrict log access, minimize retention, and prevent logs from being published as public artifacts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly recommends launching coding agents with highly autonomous flags such as --yolo or --full-auto and gives examples that can modify project state, but it does not warn that these agents may execute commands, edit files, install dependencies, or make broader system changes. In a tmux remote-control skill, this is more dangerous because the whole purpose is to automate and multiplex unattended interactive sessions, which can normalize running powerful agents without human review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

On timeout, the script prints the last captured tmux pane contents directly to stderr. In this skill's context, tmux panes may contain secrets, credentials, tokens, command output, or sensitive interactive session data, so a failed wait can unintentionally exfiltrate that information into logs or higher-level agent outputs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.