Tmux Agents

Manage background coding agents in tmux sessions. Spawn Claude Code or other agents, check progress, get results.

This skill is coherent with its stated purpose, but review and consider the following before installing or running it: - Review scripts (spawn.sh) locally: it cd's to ~/clawd — adjust or remove that if you don't want the agent working directory to be your home/project path. - Be cautious about the agent CLI flags: --dangerously-skip-permissions, --auto-edit and --full-auto can make agents accept permissions or apply edits automatically. Use them only if you trust the agent and understand the consequences. - The skill relies on external CLIs (claude, codex, gemini, ollama). Ensure those CLIs are installed and configured with the correct API keys/credentials; the skill does not declare or manage those credentials. - Treat agent names and custom commands as executable input: if you pass untrusted strings as the agent argument they will be invoked as commands inside tmux. Avoid using this skill with untrusted inputs. - Test in a safe environment first (a throwaway repo or container) and avoid running as a privileged user. If you want to limit risk, remove or alter the auto-approve flags and the hardcoded cd before using. If you want me to, I can suggest a safer spawn.sh variant that omits auto-approve flags, validates inputs, and uses a configurable working directory instead of ~/clawd.

Type: OpenClaw Skill Name: tmux-agents Version: 1.0.0 The skill bundle is classified as suspicious due to a potential command injection vulnerability in `scripts/spawn.sh`. The script's `case` statement includes a default `*)` block that directly executes the `$AGENT` variable with the `$TASK` as an argument (`$AGENT "$TASK"`). If an attacker can leverage prompt injection against the OpenClaw agent to pass an arbitrary string as the `AGENT` parameter (e.g., `'; rm -rf /; echo '`), it could lead to arbitrary command execution on the host system. Although `SKILL.md` defines a limited set of valid agents, the script itself does not enforce this validation, creating a significant risk if the calling agent can be coerced into providing malicious input.