sesh-cli
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill leverages the
seshcommand-line utility and TUI to manage tmux sessions, daemon processes, and multi-machine networking. This includes lifecycle management tasks like starting, stopping, and restarting services viasupervisorctl. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data via multiple ingestion points:
ticket create --prompt(tickets-and-blobs.md),sesh thread capture(threads.md), andsesh blob add(tickets-and-blobs.md). Boundary markers like 'guarded bracketed paste' and 'literal RPC steering' (delivery.md) are used to prevent malicious payloads from being interpreted as commands. The tool's capabilities include subprocess execution via theseshCLI, file system reads/writes viablobcommands, and mesh-wide network operations (fleet.md). Sanitization is implemented via ARGV-based substitution for plugins (integrations.md) and metadata prepending for ticket prompts. - [PRIVILEGE_ESCALATION]: Instructions include management of system-level services using
supervisorctl. While this typically involves elevated permissions, the skill frames it as the authorized procedure for maintaining the tool's daemon in production environments.
Audit Metadata