Tmux Temp

• Analyzed: May 11, 2026, 5:44 AM
• Findings: 1
• Version: 1.0.0
• Hash: 51756e7f7d9ac7011c82f9fa4f7638f40981b082f401f7b6428635666ff10875
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides an AI agent with the capability to manage interactive tmux sessions and scrape their output, which is a high-risk capability that can be used to execute commands outside of standard monitored shell environments. While the scripts (scripts/find-sessions.sh and scripts/wait-for-text.sh) are well-authored and lack evidence of malicious intent, the SKILL.md documentation explicitly instructs the agent on how to orchestrate other agents (e.g., Codex) using flags like --yolo or --full-auto to bypass interactive safety confirmations. This combination of persistent background shell access and instructions to bypass sub-tool safety checks constitutes a high-risk capability set.