The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions in SKILL.md explicitly command the agent to launch sub-agents using --dangerously-skip-permissions and --dangerously-bypass-approvals-and-sandbox, which are designed to bypass safety controls and sandboxing.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its browser interaction features.
Ingestion points: Data is pulled from external websites using cmux browser snapshot and get text as documented in references/browser.md.
Boundary markers: No delimited blocks or specific instructions to ignore embedded commands are present in the provided documentation or examples.
Capability inventory: The skill allows shell command execution (cmux send) and browser-based interactions such as clicking and filling forms (cmux browser click/fill).
Sanitization: No content validation or instruction filtering is applied to the ingested data before it is processed by the agent.
[REMOTE_CODE_EXECUTION]: Spawning parallel agents with disabled sandboxes enables the execution of unverified logic across multiple terminal sessions under the user's account context.
[COMMAND_EXECUTION]: The cmux send command is used to execute arbitrary bash commands in separate terminal surfaces. This allows for task execution that may be hidden from the primary terminal view and user oversight.

cmux