The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides scripts (spawn.py, monitor.py, health.py) that construct and execute shell commands for tmux, claude, and git using the subprocess module. It allows an agent to inject arbitrary text into a persistent tmux session via the send subcommand, which uses tmux send-keys to deliver input to the process REPL.
[PRIVILEGE_ESCALATION]: The spawn command in scripts/spawn.py is hardcoded to include the --dangerously-skip-permissions flag when launching the Claude CLI. This flag bypasses the platform's requirement for manual user approval of tool executions (such as file writes or shell commands), effectively stripping away the security sandbox for all background sub-agents spawned by this skill.
[INDIRECT_PROMPT_INJECTION]: The skill implements a monitoring loop in scripts/monitor.py that captures raw terminal output from sub-agent sessions via tmux capture-pane. This text, which could contain malicious instructions from external data processed by the sub-agent, is returned to the orchestrating agent without sanitization or boundary markers. This creates a high-risk feedback loop where a compromised sub-agent session can influence or steer the parent agent's actions.
Ingestion points: The _capture_pane function in monitor.py reads raw terminal output from active tmux sessions.
Boundary markers: Absent. The captured content is joined and sent back to the agent in a JSON payload with no delimiters or warnings.
Capability inventory: The orchestrator has access to spawn.py subcommands (spawn, send, stop, kill) which allow full control over the lifecycle and input of the child session.
Sanitization: Absent. Only ANSI formatting codes are stripped; the underlying text content is returned as-is.
[DYNAMIC_EXECUTION]: The skill dynamically constructs and executes command-line arguments for the Claude CLI at runtime. It also uses the uv tool shebang for script execution, which manages the Python environment dynamically.

kage-bunshin