peer-sessions

Warn

Audited by Socket on Oct 5, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/cmux_fleet.py

This module appears to be a legitimate cmux-based terminal fleet launcher/teardown orchestrator, with no clear indicators of stealth malware (no network activity, credential access, obfuscation, or persistence logic in this fragment). However, it intentionally performs high-impact command execution: it converts manifest-provided argv into a shell command string and injects it into terminal sessions via cmux 'send'. Therefore the security posture is dominated by trust in the manifest/state inputs and the execution environment; under compromised/untrusted inputs, the tool can execute arbitrary commands in spawned terminals and may close unintended sessions during teardown.

Confidence: 66%Severity: 62%
Audit Metadata
Analyzed At
Oct 5, 2026, 08:52 PM
Package URL
pkg:socket/skills-sh/robsonrung%2Frar-skills%2Fpeer-sessions%2F@b00c3be90d0bc26784acc9f13c7095d2ecc34de9146e0ca5635a83915b951dd8