Security audit

Tmux会话工具免费版

Security checks for vulnerabilities and agentic risk

Overview

This tmux skill does what it claims, but it can read private terminal history and send commands into live sessions without enough targeting and confirmation safeguards.

Review this skill before installing if your tmux sessions may contain secrets, private prompts, production logs, or active shells. Use it only with explicit session and pane targets, inspect minimal output, redact sensitive content, and require confirmation before any send-keys action.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is framed as a general tmux management tool and exposes read/exec-driven session discovery, pane capture, and command injection workflows without strong activation boundaries, target validation rules, or explicit user-confirmation requirements. In an agent setting, this broad scope increases the chance of operating on unintended panes or sensitive sessions and turns natural-language requests into terminal actions with insufficient constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section documents commands that both read terminal buffer contents and inject commands into a live pane, but it does not clearly warn that pane contents may include secrets, credentials, private prompts, or unrelated application output, nor that send-keys can execute arbitrary actions in the target terminal. Without these warnings and safeguards, users or agents may unintentionally exfiltrate data or trigger destructive commands.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs capturing another assistant session's recent interaction content and identifying user/assistant exchanges from the tmux pane. That can expose sensitive prompts, source code, tokens, credentials, incident data, or private conversation history from a live session, and the context of interacting with code assistants makes such leakage more likely and more damaging.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The best-practice guidance tells the agent to include user instructions and assistant replies in reports, which encourages copying potentially sensitive conversational content out of the tmux pane into another channel. This creates a direct exfiltration path from a live terminal session and can spread secrets or private material beyond the original context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The display name, summary, and the full instructional content are presented in Chinese, with no indication that other languages are available or that the language is selected based on user preference. This can violate a language/locale policy when a skill imposes a specific language without opt-in.
Content: No source excerpt is available for this finding.