tmux-for-interactive-commands

Warn

Audited by Socket on Apr 28, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/tmux-wrapper.sh

No clear evidence of embedded malware (no obfuscation, no network/exfiltration, no persistence), but the code is a powerful automation/control wrapper that (when misused) can start arbitrary commands in tmux, inject keystrokes into interactive sessions, and capture/print pane output that may contain sensitive data. The primary supply-chain security concern is abuse risk if untrusted inputs can reach ACTION/SESSION_NAME/COMMAND/send payloads; ensure strict authorization and input validation/allow-listing for session names and commands, and minimize/secure logging of captured pane output.

Confidence: 66%Severity: 62%
Audit Metadata
Analyzed At
Apr 28, 2026, 11:03 AM
Package URL
pkg:socket/skills-sh/buda-ai%2Fbuda-marketplace%2Ftmux-for-interactive-commands%2F@718f72720b061568c2e0c8ab582c58f30ef87c6a