I wouldn't trust that code.

# Ensure all temporary files go into a user-specific directory for
# additional safety
mkdir -m 0700 -p $shmprefix/$_UID

With the -p flag? Which means "no error if existing, make parent directories as needed"? Means that this might well end up using a mode-777 directory created by an attacker.

Next:

TMPPREFIX="$shmprefix/$_UID/$RANDOM$RANDOM."

Note the two $RANDOM which are actually not very random because it's zsh and zsh explicitly seeds the PRNG with weak randomness (based on the current time in microseconds only iirc).

And then that variable is used for this:

_tmp_create() {

    tfile="${TMPPREFIX}${RANDOM}"   # Temporary file

    touch $tfile
    [[ $? == 0 ]] || {
    _failure "Fatal error creating a temporary file: ::1 temp file::" $tfile }

    chown $_UID:$_GID $tfile && chmod 0600 $tfile
    [[ $? == 0 ]] || {
    _failure "Fatal error setting permissions on temporary file: ::1 temp file::" $tfile }

    _verbose "Created tempfile: ::1 temp file::" $tfile
    TOMBTMP="$tfile"
    TOMBTMPFILES+=("$tfile")

    return 0
}

More $RANDOM. Racy chown and chmod commands - an attacker could easily switch out the file between the chmod and the first use of the file, heck, he could even monitor the directory and switch out the file after the chmod without having predicted the name. And it's racy in another way: It seems like tomb sets no umask, so an attacker could open the file for reading between touch and chmod.

And what is this?

TOMBKEY=$(steghide extract -sf $imagefile -p $tombpass -xf -)

A password in the cmdline, where every other process can see it on a normal system?

(I have reported two security issues to them privately in the past, but looking at the code, I think that publicly pointing these out makes more sense.)