{"data":{"skill":{"slug":"ibrahimhka-configuring-tmux","name":"configuring-tmux","icon":"📦","repo":"https://github.com/ibrahimhka/claude-skill-configuring-tmux/tree/master/","status":"approved","author":"ibrahimhka","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"1d99e617-e2f4-45b1-a9e4-74ccbe0eee05","skill_id":"722a61e1-63fc-4f86-bcef-d6be7ad86ddf","version":2,"content_hash":"31a0c9f9facc6dace0bea60cad435604","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis found many command, network, and filesystem patterns, but review shows they are mostly tmux setup examples and framework installation guidance. The confirmed risk is medium because following the skill can clone third-party repositories, change files under the user's home directory, create a forced tmux symlink, and configure tmux status command substitutions. No malicious intent or prompt injection attempt was found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":13},{"file":"SKILL.md","line_end":61,"line_start":46},{"file":"SKILL.md","line_end":78,"line_start":75},{"file":"SKILL.md","line_end":112,"line_start":100},{"file":"SKILL.md","line_end":131,"line_start":125},{"file":"SKILL.md","line_end":138,"line_start":137},{"file":"SKILL.md","line_end":170,"line_start":168},{"file":"README.md","line_end":20,"line_start":14},{"file":"README.md","line_end":38,"line_start":35}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":138,"line_start":137},{"file":"README.md","line_end":15,"line_start":15},{"file":"README.md","line_end":20,"line_start":20}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":18,"line_start":14},{"file":"SKILL.md","line_end":37,"line_start":32},{"file":"SKILL.md","line_end":61,"line_start":48},{"file":"SKILL.md","line_end":78,"line_start":75},{"file":"SKILL.md","line_end":107,"line_start":102},{"file":"SKILL.md","line_end":131,"line_start":127},{"file":"SKILL.md","line_end":170,"line_start":146},{"file":"README.md","line_end":20,"line_start":20},{"file":"README.md","line_end":38,"line_start":37}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Home Directory tmux Configuration Changes","locations":[{"file":"SKILL.md","line_end":18,"line_start":13},{"file":"SKILL.md","line_end":61,"line_start":46},{"file":"SKILL.md","line_end":170,"line_start":168},{"file":"README.md","line_end":20,"line_start":18}],"confidence":0.84,"description":"The skill instructs agents to clone frameworks, copy tmux files, create a forced symlink, install TPM plugins, and source tmux config files. This matches the skill purpose, but it can overwrite or alter a user's existing tmux configuration if applied without review.","confidence_reasoning":"The file operations are explicit and semantically tied to tmux setup. The risk is environmental modification, not evidence of malware."},{"title":"External Repository and API Access","locations":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":138,"line_start":137},{"file":"README.md","line_end":20,"line_start":15}],"confidence":0.79,"description":"The skill references GitHub clone commands for tmux frameworks and plugins, plus a Yahoo Finance curl request for a widget. These endpoints are relevant to the stated purpose, but they still introduce third-party network trust and availability risks.","confidence_reasoning":"The network commands are directly visible and serve documented tmux installation and widget examples. No credential exfiltration or suspicious destination was found."},{"title":"tmux Status Command Substitution","locations":[{"file":"SKILL.md","line_end":78,"line_start":75},{"file":"SKILL.md","line_end":147,"line_start":146},{"file":"README.md","line_end":38,"line_start":35}],"confidence":0.82,"description":"The skill teaches tmux status entries that execute shell scripts through command substitution. This is a normal tmux feature, but any script path placed there will run repeatedly inside the user's tmux session.","confidence_reasoning":"The command-substitution behavior is explicit in tmux configuration examples. It is legitimate but can become unsafe if users insert untrusted scripts."}],"low_findings":[{"title":"Markdown Backtick Detections Are Not Ruby Execution","locations":[{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"README.md","line_end":14,"line_start":14}],"confidence":0.91,"description":"The static analyzer reported many Ruby backtick execution patterns, but the reviewed locations are Markdown code fences or inline command examples. The examples still include shell commands, but the Ruby-specific detection is a false positive.","confidence_reasoning":"The files are Markdown documentation, not Ruby source. The backticks delimit examples rather than executing code."},{"title":"Weak Cryptography Static Findings Are False Positives","locations":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"README.md","line_end":3,"line_start":3}],"confidence":0.94,"description":"The scanner flagged weak cryptography at descriptive text locations, but no cryptographic algorithm or password hashing implementation appears in the reviewed files. No evidence found for real cryptographic behavior.","confidence_reasoning":"The cited lines describe the skill and do not contain crypto APIs, hashes, or encryption instructions. This is a strong false positive."},{"title":"Troubleshooting Commands Are Benign","locations":[{"file":"SKILL.md","line_end":90,"line_start":90},{"file":"SKILL.md","line_end":161,"line_start":159}],"confidence":0.88,"description":"The reported reconnaissance-like patterns are tmux troubleshooting references, such as checking tmux options and known status bar mistakes. They do not enumerate host secrets or collect system identity data.","confidence_reasoning":"The commands inspect tmux configuration state for troubleshooting. I found no semantic evidence of host reconnaissance beyond normal tmux diagnostics."}],"dangerous_patterns":[{"title":"Forced Symlink to tmux Config","locations":[{"file":"SKILL.md","line_end":16,"line_start":14}],"confidence":0.86,"description":"The oh-my-tmux setup uses a forced symlink for the user's tmux config. This can replace an existing tmux config link or file if used without a backup.","confidence_reasoning":"The symlink command is explicit and uses force behavior. The risk is configuration overwrite, not malicious intent."},{"title":"Repeated Shell Execution from Status Bar","locations":[{"file":"SKILL.md","line_end":78,"line_start":75},{"file":"README.md","line_end":38,"line_start":37}],"confidence":0.83,"description":"tmux status examples execute scripts from the user's config directory. Those scripts can run repeatedly when the tmux status bar refreshes.","confidence_reasoning":"The command-substitution syntax is visible in both files. This is normal tmux behavior but security-sensitive when script content is untrusted."},{"title":"Third-Party Network Fetch for Finance Widget","locations":[{"file":"SKILL.md","line_end":138,"line_start":134}],"confidence":0.76,"description":"The finance widget example fetches market data from Yahoo Finance with curl. It uses a timeout and a public API endpoint, but it still makes external network requests.","confidence_reasoning":"The network request is explicit and relevant to the widget example. I found no evidence that it sends local secrets."}],"files_scanned":2,"total_lines":227,"audit_model":"codex","audited_at":"2026-06-30T04:22:04.686+00:00","created_at":"2026-06-30T04:44:34.551319+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":5,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}