Security audit results

{
  "notes": "Reviewed scripts and README; functionality limited to tmux session management and local pane capture.",
  "risks": [],
  "summary": "No evidence of exfiltration, obfuscation, or undeclared network activity. Scripts interact with local tmux sessions only.",
  "verdict": "pass",
  "allowNetwork": [],
  "requireHumanReview": false
}

{
  "requires": {
    "env": [],
    "bins": [
      "tmux"
    ],
    "config": [],
    "anyBins": []
  },
  "installers": [],
  "references": {
    "tools": [],
    "connectors": []
  },
  "dependencies": []
}

{
  "license": "MIT",
  "allowlisted": true
}

{
  "name": "Tmux",
  "type": "tool",
  "license": "MIT",
  "version": "1.0.0",
  "homepage": "https://clawdhub.com/steipete/tmux",
  "security": {
    "openSource": true,
    "safeListed": false,
    "auditRequired": true,
    "requireSource": false,
    "requiresAudit": true,
    "repositoryHost": null,
    "declaredOpenSource": true,
    "declaredAuditRequired": null,
    "repositoryHostAllowed": null
  },
  "repository": null,
  "description": "Remote-control tmux sessions for interactive CLIs by sending keystrokes and scraping pane output.",
  "sourceBytes": 4364,
  "capabilities": [
    "terminal-session-manage",
    "terminal-input-send",
    "terminal-output-capture"
  ],
  "sourceCommit": null,
  "sourceSha256": "9c889235a50df504c921a1cb59365599d16075d47abb5396e7697f28ac3e75b3"
}

{
  "reason": "sandbox deferred in v1",
  "skipped": true
}

{
  "flags": [],
  "fileCount": 3,
  "sourceScan": {
    "totalFiles": 3,
    "scannedFiles": 3,
    "skippedBytes": 0,
    "skippedFiles": 0,
    "suspiciousFiles": [
      {
        "path": "scripts/find-sessions.sh",
        "reasons": [
          "network"
        ],
        "excerpts": [
          "Usage: find-sessions.sh [-L socket-name|-S socket-path|-A] [-q pattern]",
          "List tmux sessions on a socket (default tmux socket if none provided).",
          "  -L, --socket       tmux socket name (passed to tmux -L)"
        ]
      },
      {
        "path": "SKILL.md",
        "reasons": [
          "network",
          "exec"
        ],
        "excerpts": [
          "## Quickstart (isolated socket, bash tool)",
          "SOCKET=\"$SOCKET_DIR/clawdbot.sock\"",
          "tmux -S \"$SOCKET\" new -d -s \"$SESSION\" -n shell",
          "tmux -S \"$SOCKET\" new -d -s \"$SESSION\" -n shell",
          "- Check for shell prompt (`❯` or `$`) to detect completion"
        ]
      }
    ]
  }
}