Code Tmux

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:04 AM UTC
• Version: 1.3.0

Overview

This skill has a coherent coding-workflow purpose, but it launches persistent coding agents with reduced safeguards and automatically exposes environment files that may contain secrets.

Review carefully before installing. Use this only if you intentionally want coding agents running in persistent tmux sessions, remove the dangerous Claude permission-bypass flag, avoid linking full `.env` files unless absolutely required, and verify worktree/session state before cleanup.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:35

Finding

Delegated Agent Runs with Permission Checks Disabled

Content

View full analysis

# worktree + tmux in one command: claude -w --tmux --dangerously-skip-permissions ``` The troubleshooting instructions repeat the unsafe option: ```bash tmux send-keys -t "nvm use 20 && claude --dangerously-skip-permissions" Enter ``` ### Technical Analysis The `--dangerously-skip-permissions` option disables Claude Code's normal permission confirmation controls. Git worktree isolation only separates repository branches and working directories; it does not restrict the agent's access to the host filesystem, user credentials, processes, network, or other repositories. Consequently, a delegated coding agent can perform host-user-level operations without an interactive authorization boundary. Repository instructions, source comments, issue descriptions, or other attacker-controlled context processed by the agent may induce it to run commands unrelated to the legitimate coding task. ### Attack Path 1. An attacker places adversarial instructions in repository content or another input consumed during a coding task. 2. The Skill launches Claude Code with `--dangerously-skip-permissions`. 3. The delegated agent processes the attacker-controlled instructions. 4. The agent runs shell commands or accesses resources without requesting permission. 5. Those operations execute with the privileges and resource access of the user running OpenClaw or Claude Code. ### Impact Assessment Successful exploitation can provide access equivalent to the host account running the agent. Depending on that account's environment, the affected scope may include local files, source repositories, SSH configuration, cloud credentials, developer tokens, running processes, and network-accessible services. The reviewed Skill does no ...[truncated 114 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:48

Finding

Secret-Bearing Environment Files Are Automatically Exposed to Delegated Agents

Content

View full analysis

/.env /.env ln -sf /.env.local /.env.local # if exists ``` The behavior is mandatory under the Skill rules: ```text - **Always** symlink `.env` files — don't copy ``` The troubleshooting guide reinforces the same behavior: ```bash ln -sf /.env /.env ``` ### Technical Analysis Files named `.env` and `.env.local` commonly contain API keys, database credentials, signing secrets, service tokens, and other sensitive configuration. The Skill exposes these files to every delegated agent workspace without determining whether the task requires them. Because symbolic links point to the original files, access is not limited to a disposable copy. A process operating in the worktree can read the original secrets and may also modify or truncate the source file if filesystem permissions permit it. The risk is compounded by launching Claude Code with permission checks disabled. No direct exfiltration command was identified in the reviewed project. The vulnerability is the unnecessary exposure of sensitive data to an unrestricted, network-capable delegated process. ### Attack Path 1. A project contains credentials in `.env` or `.env.local`. 2. The Skill creates symbolic links to those files inside the new worktree. 3. A delegated agent, repository script, dependency, or attacker-controlled instruction accesses the linked path. 4. The process reads the credentials or modifies the original environment file through the symbolic link. 5. Read credentials may then be used against the services for which they are valid; network-capable tooling could also transmit them externally. ### Impact Assessment The exposed privileges de ...[truncated 357 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:43

Finding

Unvalidated Values Are Submitted to Interactive Shell Sessions

Content

View full analysis

worktree add -b main # Symlink env files ln -sf /.env /.env ln -sf /.env.local /.env.local # if exists # Create tmux session and launch agent tmux new-session -d -s -c tmux send-keys -t "nvm use 20 && " Enter ``` Task content and later user responses are also submitted into the terminal session: ```bash tmux send-keys -t -l -- "Your task here. Before making any changes, show me a plan of what you intend to do and wait for my approval." sleep 0.1 tmux send-keys -t Enter ``` ```bash tmux send-keys -t -l -- "" sleep 0.1 tmux send-keys -t Enter ``` ### Technical Analysis The workflow interpolates project paths, worktree paths, branch names, tmux session names, a remembered tool command, task text, and user responses without specifying strict validation or shell-safe encoding. The Skill permits the selected tool to be “any CLI tool name,” and then inserts that value after `nvm use 20 &&`. `tmux send-keys -l` prevents tmux from interpreting the supplied text as key names, but it does not prevent a foreground shell from interpreting shell metacharacters after the separate `Enter` submission. If the expected interactive agent has exited, failed to start, or returned control to a shell, forwarded task or response text can become a shell command. Likewise, an attacker-controlled or corrupted remembered tool preference can contain shell syntax rather than a single allowlisted executable. Unquoted template values used in worktree and tmux setup commands a ...[truncated 1405 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:20

Finding

Installation Executes a Mutable Unpinned Package Release

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims changes will only occur after a plan is shown and approved, but the Claude invocation uses --dangerously-skip-permissions, which disables an important execution safeguard. In a coding-agent workflow, that mismatch can allow file modifications or command execution before meaningful human review, especially if the agent receives a malformed or adversarial task.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documentation omits a clear warning that the recommended Claude command runs in dangerous permission-bypass mode. Users may reasonably assume normal safeguards apply, leading them to approve use of a workflow that can act with fewer checks than expected.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Symlinking the project's .env into the agent worktree grants the coding agent direct access to sensitive credentials that may not be necessary for the task. If the agent is compromised, manipulated by prompt injection, or simply verbose in logs/output, those secrets can be exfiltrated or misused.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

git -C <project> worktree add -b <branch> <worktree-path> main

# Symlink env files
ln -sf <project>/.env <worktree-path>/.env
ln -sf <project>/.env.local <worktree-path>/.env.local   # if exists

# Create tmux session and launch agent

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Symlinking .env.local similarly exposes local secrets, developer-specific tokens, and possibly production credentials to the coding tool running in the worktree. Because local env files often contain the most privileged or least-reviewed secrets, this raises the risk of credential theft and lateral movement.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

# Symlink env files
ln -sf <project>/.env <worktree-path>/.env
ln -sf <project>/.env.local <worktree-path>/.env.local   # if exists

# Create tmux session and launch agent
tmux new-session -d -s <task-name> -c <worktree-path>

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 19)May include surrounding context.

text

Either remove the existing worktree first, or use a different branch name:
```bash
git worktree remove /tmp/task-x
# then retry

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 51)May include surrounding context.

text

Either remove the existing worktree first, or use a different branch name:
```bash
git worktree remove /tmp/task-x
# then retry

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The guidance instructs users to symlink the main project's .env into a secondary worktree, which can propagate secrets into additional execution contexts and tools. In a skill designed to run coding agents in persistent tmux sessions across isolated worktrees, that increases the chance that credentials are exposed to agent processes, logs, shell history, or unintended code running in the worktree.

Content

Scanner excerpt · references/troubleshooting.md (reported line 23)May include surrounding context.

then retry

text

## .env not found in worktree

```bash
ln -sf <project>/.env <worktree-path>/.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The repeated .env reference reflects the same unsafe pattern: copying access to environment secrets into an isolated worktree used by persistent coding agents. Because this skill explicitly supports automated coding tools operating in those worktrees, the context makes the exposure more dangerous than ordinary local troubleshooting guidance.

Content

Scanner excerpt · references/troubleshooting.md (reported line 26)May include surrounding context.

.env not found in worktree

bash

ln -sf <project>/.env <worktree-path>/.env

tmux session already exists

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to install the skill via npx clawhub@latest install claude-code-tmux, which pulls and executes the latest published package without pinning to a specific trusted version. If the upstream package is compromised, typosquatted, or a malicious version is published, users could execute attacker-controlled code during installation. In a developer tool that manages code and shells out to tmux/CLI agents, this supply-chain exposure is more dangerous because the target audience is likely to run the command locally with access to source code and credentials.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation description is broad enough to trigger on common requests such as build, fix, refactor, or review code, which increases the chance this high-privilege workflow is invoked by default. Because the skill launches persistent agent sessions and may expose repository secrets or perform edits, overbroad activation materially expands attack surface and misuse likelihood.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs symlinking .env and .env.local into agent worktrees without warning that this exposes live credentials and secrets to whichever coding tool is launched there. In an interactive agent setting, this can unnecessarily broaden secret access and increase the blast radius of prompt injection, tool compromise, or accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The cleanup steps remove worktrees without warning about preserving or checking for uncommitted changes first. In a persistent coding workflow, that can lead to accidental loss of in-progress work or destruction of forensic evidence after an unsafe agent action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document instructs users to run git worktree remove /tmp/task-x in two places as a troubleshooting step. Although one later note says the branch is preserved, the instructions do not clearly warn that the worktree directory itself will be removed and that uncommitted changes in that worktree could be affected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The troubleshooting instructions include tmux kill-session -t <name>, which forcibly terminates an existing session and may discard in-progress interactive state. The markdown does not warn the user that this is destructive or advise verifying that the session can be safely removed before running it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.