The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates an attack surface for indirect prompt injection because it allows the agent to ingest and analyze terminal buffers which could display arbitrary text, remote logs, or third-party outputs.
Ingestion points: Terminal pane buffers are fetched into the context via tmux capture-pane inside SKILL.md, scripts/tmux-run.sh, and scripts/tmux-watch.sh.
Boundary markers: scripts/tmux-run.sh injects randomized unique boundary markers (__TMUX_RUN_${$}_${RANDOM}__) to delineate command output blocks from surrounding shell text, though it lacks specialized instructions telling the model to ignore executable strings embedded within the captured payload itself.
Capability inventory: Includes local execution of tmux control commands (send-keys, capture-pane, pipe-pane, wait-for), temporary file storage under /tmp/, and process signaling (kill).
Sanitization: Outputs are handled as unescaped raw strings and extracted via line-based matching (sed and grep) without deep syntax validation.
[COMMAND_EXECUTION]: The helper scripts package local terminal execution capabilities, dynamically invoking tmux binary wrappers and utilities like sed, grep, tail, and kill to synchronize execution states and parse command blocks.

tmux-control