dmux-workflows
Warn
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs users to download and install the dmux tool from a repository not associated with a trusted organization (github.com/standardagents/dmux).
- [COMMAND_EXECUTION]: Orchestration logic depends on the execution of local scripts, including scripts/orchestrate-worktrees.js and scripts/orchestrate-codex-worker.sh, which perform shell operations.
- [REMOTE_CODE_EXECUTION]: The ECC helper utilizes a launcherCommand field within plan.json to spawn worker processes. This dynamic command assembly allows for potential execution of arbitrary shell commands if the JSON content is influenced by untrusted data.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its pattern of merging parallel agent outputs into the main session.
- Ingestion points: Untrusted task definitions in plan.json and data merged from multiple terminal panes.
- Boundary markers: Absent; there are no instructions or delimiters provided to isolate the main agent context from sub-agent output.
- Capability inventory: High; includes capabilities to execute Node.js scripts, bash scripts, and manage git worktrees.
- Sanitization: Absent; the skill lacks input validation for the launcherCommand and worker task strings before they are processed by the shell.
Audit Metadata