The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides the ability to send arbitrary keystrokes and commands to a terminal session via the tmux send-keys command. This allows the agent to execute any shell command or interact with any CLI tool (like Python or GDB) running within the tmux pane.
[INDIRECT_PROMPT_INJECTION]: The skill regularly captures and reads terminal output to synchronize with tool prompts or monitor progress, which creates a vulnerability where malicious data in the terminal could influence agent behavior.
Ingestion points: Pane output is captured via tmux capture-pane in SKILL.md and the scripts/wait-for-text.sh helper script.
Boundary markers: The skill does not define specific boundary markers or instructions to ignore embedded commands within the captured terminal text.
Capability inventory: The agent has the capability to write (send-keys), read (capture-pane), and manage sessions (kill-session).
Sanitization: While the documentation suggests using the -l flag for literal sends to prevent shell expansion, there is no sanitization or filtering applied to the text captured from the terminal panes before it is processed by the agent.
[DATA_EXFILTRATION]: The scripts/find-sessions.sh script includes an --all flag that scans the shared CLAUDE_TMUX_SOCKET_DIR (defaulting to /tmp/claude-tmux-sockets). This allows the agent to enumerate and see metadata (session names, start times) for all tmux sessions created by any agent instance on the same host, which may expose information about other active tasks.

tmux