Security audit

Claude Code tmux Runner

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing Claude Code tmux jobs, but it uses high-impact background execution with shell command templates that can mishandle user-supplied task text.

Review the runner script before installing or using this skill. Only launch tasks you trust, avoid placing shell metacharacters in task names or IDs, and check the listed ~/.openclaw log, workspace, and state directories because prompts and generated files may persist after the chat moves on.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:14
Finding: Shell Command Injection Through User-Controlled Task Arguments
Content: View full analysis
``` ```bash ~/.openclaw/scripts/claude-tmux.sh stop ~/.openclaw/scripts/claude-tmux.sh stop-all ``` The documented workflow establishes that the task description originates from the user: ```markdown 1. User says "use Claude Code xxx" → Optimize prompt → Show for approval 2. User confirms → Start background task → Return immediately ``` ### Technical Analysis The Skill directs an agent with the `Bash` tool to place user-supplied task descriptions and identifiers into shell command templates. It does not require strict input validation, shell escaping, or execution through an argument-safe process API. Placing the task description inside double quotes is insufficient protection. Bash still evaluates command substitutions such as `$(command)` and backtick expressions inside double-quoted strings. The task-name and task-ID placeholders are shown without quoting, which additionally permits whitespace splitting, redirection, pipelines, command separators, and other shell metacharacters if the agent performs direct textual substitution. For example, a task description containing: ```text Review the project $(touch /tmp/claude-runner-injected) ``` could produce: ```bash ~/.openclaw/scripts/claude-tmux.sh start "Review the project $(touch /tmp/claude-runner-injected)" audit ``` Bash would execute `touch /tmp/claude-runner-injected` before invoking the runner script. Exploitability depends on the agent constructing and executing these tem ...[truncated 1872 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation description uses broad terms like 'Claude Code', 'background task', 'parallel', and 'tmux', which can match routine conversation and cause the skill to activate unexpectedly. Because this skill can launch background processes and write files, overbroad activation increases the chance of unintended execution of persistent actions the user did not clearly request.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill is explicitly granted Write capability and is designed to manage long-lived background tasks, logs, and generated files, creating persistent state beyond the immediate conversation. In this context, persistence is security-relevant because task outputs, prompts, or logs may contain sensitive information and remain on disk without strong disclosure or lifecycle controls.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: claude-tmux-runner description: Claude Code parallel task manager with tmux backend. For running multiple Claude Code tasks concurrently, monitoring progress, and managing background jobs. Activate when user mentions: Claude Code, background task, parallel, tmux. tools: Bash, Read, Write --- # Claude Code tmux Runner

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill describes non-blocking background execution but does not prominently warn that it will create files and persist logs and state under user directories. This can mislead users about the persistence and side effects of using the skill, reducing informed consent and increasing the risk of sensitive data being stored unexpectedly on disk.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The workflow explicitly instructs the system to 'Start background task' and return immediately, which creates asynchronous persistent execution outside the user's immediate view. This increases the risk of unnoticed continued processing, lingering sessions, and accumulation of logs or generated artifacts, especially if the task prompt contains sensitive content.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
## Workflow 1. User says "use Claude Code xxx" → Optimize prompt → Show for approval 2. User confirms → Start background task → Return immediately 3. User can continue chatting → Non-blocking 4. User asks "how is Claude doing" → Check status → Return progress