tmux-agent-tools

No independent malware behavior is evident. This is a task runner whose core, documented behavior is to execute shell commands from a manifest. It is unsafe to use with an untrusted manifest because those commands run with the caller's privileges. There is also a separator-parsing weakness and a mismatch between the documented and implemented fail_fast behavior.

No explicit malware payload is evident. The principal security risk is that commands from the manifest are executed as arbitrary shell code despite the read-only description. Use only trusted manifests; command output may also disclose sensitive information, and the configured summary path can be overwritten.