tmux

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow has the parent read a subagent's result file (SKILL.md:57), and a delegated task such as "Research X" can make the subagent fetch arbitrary web pages, so outsider text can reach the parent only if the agent chooses to research and the attacker publishes poison, with no forced delivery path.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.40). The skill mainly orchestrates tmux windows and does not touch system files, sudo, or user accounts, but it makes --permission-mode dangerous the default for every spawned agent, which bypasses the permission safeguards of unattended subagents.