Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This package teaches an AI agent to drive tmux, a terminal multiplexer: it creates isolated socket directories, starts sessions, sends keystrokes and commands into panes, and captures pane text. Two helper scripts list sessions on sockets and poll pane output for a pattern. The code stays within that stated purpose, but shell-level control and pane capture can expose sensitive terminal content, and the documentation shows unattended `--yolo` coding-agent examples. No hidden network destinations, encoded payloads, persistence, or direct credential-file access were found. The verdict is CAUTION because a user should review the shell-control and terminal-output-exposure risks before installing this in an agent with credentials or spend authority.
| Declared purpose | Remote-control tmux sessions for interactive CLIs by sending keystrokes and scraping pane output. |
| Observed behavior | The package consists of SKILL.md plus two bash helper scripts. It instructs the agent to create tmux sockets under a clawdbot-specific directory, start sessions, send keystrokes/commands to panes, capture pane history, scan socket directories for sessions, and wait for pane text to match a pattern. The scripts use local tmux, bash, grep, date, and sleep; no network calls, download-and-execute, persistence, wallet/payment code, or encrypted/obfuscated payloads were observed. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | The skill sends keystrokes and commands into tmux panes and runs bash helper scripts. Examples: SKILL.md line 20 uses `tmux send-keys` to launch a Python REPL; both scripts are bash programs. |
| filesystem_write | needed | SKILL.md line 15 runs `mkdir -p "$SOCKET_DIR"` to create the tmux socket directory; tmux then creates socket files there. |
| filesystem_read | needed | find-sessions.sh line 83 expands all entries in the socket directory, and line 93 checks for Unix sockets; wait-for-text.sh captures pane output via tmux. |
| network | exceeds purpose | No network code was observed. The only domain is an informational link in skill-card.md line 9. |
| credentials | exceeds purpose | No stored credentials are read directly, but captured pane text could include tokens or secrets, and wait-for-text.sh prints it to stderr on timeout (line 78; risk acknowledged in skill-card.md line 32). |
| install_packages | exceeds purpose | SKILL.md line 99 suggests `pnpm install` before running codex in fresh clones; this is documented guidance rather than an automated package installation by the helper scripts. |
| severity | finding |
|---|---|
| info | Declared purpose This frontmatter line states the skill's purpose; observed behavior matches it. SKILL.md:3 description: Remote-control tmux sessions for interactive CLIs by sending keystrokes and scraping pane output. |
| info | Uses isolated tmux socket directory The guide directs tmux to a dedicated socket directory, which avoids interfering with the user's default tmux server. SKILL.md:14 SOCKET_DIR="${CLAWDBOT_TMUX_SOCKET_DIR:-${TMPDIR:-/tmp}/clawdbot-tmux-sockets}" |
| info | Sends shell commands into a pane This example sends a Python REPL launch command as keystrokes to a tmux pane. Shell-level control is necessary for the declared purpose but should be reviewed. SKILL.md:20 tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- 'PYTHON_BASIC_REPL=1 python3 -q' Enter |
| medium | High-authority coding-agent example The documentation shows launching coding agents with `--yolo`; line 101 says Codex needs `--yolo` or `--full-auto`. If followed, this can modify repositories or run commands without interactive review. skill-card.md line 28 acknowledges this risk. SKILL.md:81 tmux -S "$SOCKET" send-keys -t agent-1 "cd /tmp/project1 && codex --yolo 'Fix bug X'" Enter |
| low | Documentation suggests installing packages The guide recommends running pnpm install before codex in fresh clones. The helper scripts do not perform this installation automatically. SKILL.md:99 - `pnpm install` first before running codex in fresh clones |
| low | Cleanup command kills all sessions on a socket This command terminates all tmux sessions on the selected socket. It is within the skill's purpose but destructive if pointed at the wrong socket. SKILL.md:106 tmux -S "$SOCKET" list-sessions -F '#{session_name}' | xargs -r -n1 tmux -S "$SOCKET" kill-session -t |
| low | Scans all entries in socket directory In `--all` mode the script iterates over every entry in the socket directory and lists tmux sessions from each Unix socket found. This could list sessions outside the current socket if other sockets are present there. scripts/find-sessions.sh:83 sockets=("$socket_dir"/*) |
| medium | Prints captured pane text on timeout When the pattern is not found before the deadline, the script writes the captured pane history to stderr. This can expose tokens, private source, or other sensitive terminal output; skill-card.md line 32 acknowledges this risk. scripts/wait-for-text.sh:78 printf '%s\n' "$pane_text" >&2 |
| medium | Author-disclosed secret-exposure risk The package itself warns that wait-for-text.sh may print sensitive terminal content on timeout. This supports a CAUTION verdict. skill-card.md:32 Risk: `wait-for-text.sh` can print captured pane history to stderr on timeout, which may expose tokens, private source, or other sensitive terminal output. |
| info | Documentation link only The only domain present is an informational publisher link. No network calls were observed in the scripts. skill-card.md:9 [steipete](https://clawhub.ai/user/steipete) |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| Binaries invoked | bash, git, python, python3 |
| Environment variables read | CLAWDBOT_TMUX_SOCKET_DIR, SESSION, SOCKET, SOCKET_DIR, TMPDIR |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 5 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 121 | 9801a7dde4106af5… |
_meta.json | 6 | 53fb14f56ed9837a… |
scripts/find-sessions.sh | 112 | a137d03b3b373324… |
scripts/wait-for-text.sh | 83 | 96bc42702f7353c3… |
skill-card.md | 56 | 21db8901f3be9d40… |
For agents
JSON: https://agenteconomy.report/k/tmux.audit.json · badge: https://agenteconomy.report/k/tmux.audited.svg ·
skill rating: /k/tmux · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).