tmux

This tmux skill is a legitimate orchestration helper for interacting with interactive CLIs by sending keystrokes and scraping terminal output. However, its core capability—programmatic injection of keystrokes into tmux panes and capturing pane contents—provides powerful primitives equivalent to arbitrary command execution and read-access to any data visible in the terminal. Those primitives are appropriate for trusted, local automation but are high-risk when used by untrusted agents, third-party code, or on sockets placed in shared filesystem locations. Key risks: command injection (send-keys), credential exposure via capture-pane, transitive supply-chain risk from running package installs and external CLIs within panes, and potential session hijacking if socket permissions are lax. Mitigations before use should include restricting who can write to the socket directory, auditing helper scripts referenced by the README, avoiding running untrusted commands in panes, and using least-privilege processes inside sessions. Overall I find no evidence of intentionally malicious code in this README itself, but the described capabilities are powerful and must be used with caution.