Tmux Manager

Manage tmux sessions using the tmux-manager.py script. Use when asked to create, kill, restart, list, or inspect tmux sessions, send commands to sessions, ta...

This skill appears to do what it says — manage tmux sessions. Before installing or running it, review any tmux-sessions.yaml you will use: the config can contain pre_hook, post_hook, window/pane commands, and env values that will execute as shell commands or be injected into running terminals. Do not run untrusted configs or hooks as a privileged user. Use --dry-run and --validate first, inspect the sample YAML, and ensure uv and tmux are installed from trusted package sources. If you need to harden usage, avoid enabling hooks or limit configs to commands you control.

Type: OpenClaw Skill Name: tmux-manager Version: 1.0.0 The tmux-manager skill provides a functional utility for managing tmux sessions but contains high-risk patterns. Specifically, `scripts/tmux-manager.py` uses `subprocess.run(shell=True)` to execute `pre_hook` and `post_hook` commands defined in a YAML configuration file, creating a shell injection vulnerability if the config is untrusted. Additionally, the script's ability to send arbitrary strings to terminal panes (`--send-keys`) and the inclusion of sample commands in `SKILL.md` and `README.md` that use flags like `--dangerously-skip-permissions` represent a significant attack surface, although no clear evidence of intentional malice or data exfiltration was found.