dmux-workflows

Warn

Audited by Gen Agent Trust Hub on Apr 6, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation instructs users to download and install the dmux tool from a repository not associated with a trusted organization (github.com/standardagents/dmux).
  • [COMMAND_EXECUTION]: Orchestration logic depends on the execution of local scripts, including scripts/orchestrate-worktrees.js and scripts/orchestrate-codex-worker.sh, which perform shell operations.
  • [REMOTE_CODE_EXECUTION]: The ECC helper utilizes a launcherCommand field within plan.json to spawn worker processes. This dynamic command assembly allows for potential execution of arbitrary shell commands if the JSON content is influenced by untrusted data.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its pattern of merging parallel agent outputs into the main session.
  • Ingestion points: Untrusted task definitions in plan.json and data merged from multiple terminal panes.
  • Boundary markers: Absent; there are no instructions or delimiters provided to isolate the main agent context from sub-agent output.
  • Capability inventory: High; includes capabilities to execute Node.js scripts, bash scripts, and manage git worktrees.
  • Sanitization: Absent; the skill lacks input validation for the launcherCommand and worker task strings before they are processed by the shell.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 6, 2026, 04:01 AM
Security Audit — agent-trust-hub — dmux-workflows