Skill

Dispatch coding tasks to tmux sessions via Sandboxer. Use when you need to spawn Claude Code, Gemini, OpenCode, bash, or lazygit sessions in workspace repos, monitor their progress, or send them commands.

This skill is coherent with its stated goal (controlling tmux sessions and repo workspaces), but it requires trusting a high‑privilege, unauthenticated local service that can run commands and read/write files under /root. Only install/use on a dedicated, fully isolated machine you control. Before enabling: verify the actual Sandboxer server implementation (source code, auth options), restrict access to localhost and firewall outbound callbacks, avoid running as root if possible, limit agent autonomy, and do not use it on shared or production hosts. The notify_url feature can leak session output to external endpoints — treat it as a potential exfiltration vector unless you control the callback endpoints.

Type: OpenClaw Skill Name: sandboxer-tmux Version: 1.0.1 This skill is highly suspicious due to its extremely broad capabilities and the explicit instructions for its use. It provides full shell access (`type=bash`), arbitrary command execution (`/api/send`), and file read/write access (`/api/workspace/W/file/PATH`) via an unauthenticated API exposed on `localhost:8081`. The `SKILL.md` explicitly states it grants 'full access to tmux sessions, workspace files, and terminal output on your server' and is 'Intended for dedicated AI machines where agents run with root access.' While these capabilities might align with its stated purpose of dispatching coding tasks, they create a massive attack surface, enabling full system compromise if the agent or the local machine is compromised. The lack of authentication on localhost for such powerful operations is a critical vulnerability.