Is yangliu2060/startmux safe?
https://github.com/yangliu2060/startmux
This is a legitimate tmux automation skill for creating multi-agent workstations. While some canary files were accessed during installation (likely by system authentication processes), no actual data exfiltration occurred and the skill content contains only standard tmux operations.
Category Scores
Findings (3)
MEDIUM Sensitive canary files accessed during installation -20 ▶
Multiple honeypot files including .env, .ssh/id_rsa, .aws/credentials, and .npmrc were accessed during the installation process. However, this appears to be system-level processes (SSH authentication, sudo) rather than the skill itself.
LOW Powerful terminal control capabilities -10 ▶
The skill provides extensive terminal automation capabilities including remote command execution and output capture via tmux. While legitimate for its stated purpose, these features could be misused if combined with malicious input.
INFO All canary files remained intact -5 ▶
Despite being accessed, all honeypot files maintained their original content with no modifications or exfiltration detected.