The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use sudo for creating symbolic links in system-level directories (/usr/local/bin/cmux), which constitutes privilege escalation.
[EXTERNAL_DOWNLOADS]: The skill directs the installation of external software and AI agent skills from the 'manaflow-ai' organization using brew and npx. These are external, non-trusted sources.
[REMOTE_CODE_EXECUTION]: The command cmux browser eval allows for the execution of arbitrary JavaScript within controlled WKWebView browser surfaces, enabling dynamic code execution.
[CREDENTIALS_UNSAFE]: The skill provides commands to export browser session states, including cookies and authentication data, to local files (cmux browser state save /tmp/auth.json), which could lead to credential exposure if accessed by unauthorized processes.
[PROMPT_INJECTION]: The skill establishes a significant attack surface for indirect prompt injection by ingesting untrusted data from terminal screens and browser content (cmux read-screen, cmux browser snapshot) and using it to drive sensitive capabilities such as command execution (cmux send) and browser manipulation without explicit sanitization or boundary markers.

cmux