Security audit

Code Tmux

Security checks across malware telemetry and agentic risk

Overview

This skill is for high-privilege coding-agent delegation, but it normalizes bypassed permissions and broad secret exposure that users should review before installing.

Install only if you intentionally want a separate persistent coding-agent workflow and are comfortable reviewing its commands first. Remove or avoid permission-skipping flags, do not expose full .env files to spawned agents unless necessary, and verify exact tmux session names and worktree paths before running cleanup commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill says the agent must show a plan and wait for approval before touching files, but the recommended `claude -w <branch> --tmux --dangerously-skip-permissions` explicitly disables permission checks at the tool layer. That creates a policy/implementation mismatch: if the agent receives a task that implies edits or execution, the CLI may proceed without the intended human gate, undermining the claimed safeguard.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation text is very broad (`build, fix, refactor, or review code`) and can cause this high-privilege automation skill to trigger in many ordinary coding contexts without clear user intent. Because the skill sets up persistent sessions, worktrees, and may launch external coding agents, overbroad activation increases the chance of unintended execution of sensitive operations.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill instructs automatic symlinking of `.env` and `.env.local` into every task worktree with no warning, consent, or scope restriction. This exposes secrets to whichever external coding agent is launched in that worktree and expands the blast radius of credential leakage, especially for third-party or less-trusted CLI agents.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The troubleshooting guide recommends destructive commands like killing tmux sessions and removing worktrees without any warning, scope validation, or confirmation step. In an agent skill that automates shell actions, this can lead to unintended deletion of active work environments or interruption of unrelated sessions if placeholders are substituted incorrectly.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The documentation explicitly advises launching Claude with '--dangerously-skip-permissions', which disables an important safety control around tool or filesystem access. In a persistent coding-agent skill, normalizing this flag makes it easier for the agent to perform sensitive actions without review, increasing the blast radius of prompt injection, operator error, or malicious task content.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

No suspicious patterns detected.