cmux
Fail
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: HIGHPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCE
Full Analysis
- [PRIVILEGE_ESCALATION]: The documentation provides an instruction to use
sudoto create a symbolic link for thecmuxbinary in/usr/local/bin/cmux. - [COMMAND_EXECUTION]: The skill enables the agent to send arbitrary input and commands to other terminal panes using
cmux sendandcmux send-key, and it documents the use ofnc -Ufor low-level socket communication with the application. - [INDIRECT_PROMPT_INJECTION]: The skill reads terminal screen content and captures browser snapshots, which can pull untrusted instructions into the agent's context. Ingestion points:
cmux read-screen(SKILL.md) andcmux browser snapshot(references/viewers.md). Boundary markers: None. Capability inventory: Ability to execute commands on other terminal surfaces viacmux send. Sanitization: None provided. - [EXTERNAL_DOWNLOADS]: The documentation includes commands to install the cmux application using Homebrew and add supplemental agent skills via
npx. - [REMOTE_CODE_EXECUTION]: The instruction to use
npx skills add manaflow-ai/cmuxinvolves downloading and executing remote code during the skill installation process. - [PERSISTENCE]: The
cmux hooks setupcommand modifies agent configurations to enable session resume functionality, establishing persistent hooks across different terminal environments.
Recommendations
- AI detected serious security threats
Audit Metadata