cmux-orchestration
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
rtkCLI to manage workspaces and interact with terminal-based worker agents. It specifically instructs the agent to use flags like--dangerously-skip-permissionsand--yolowhich disable interactive security prompts, allowing worker agents to execute commands autonomously.\n- [PROMPT_INJECTION]: The skill facilitates a workflow where autonomous worker agents process potentially untrusted external data, presenting an attack surface for indirect prompt injection.\n - Ingestion points: Worker agents are directed to research and scan external sources such as repository files, documentation, and APIs (referenced in
references/plan-mode.md).\n - Boundary markers: The skill suggests structuring prompts as "delegation packets," but does not implement technical delimiters or safety warnings to isolate untrusted data from instructions.\n
- Capability inventory: Worker agents are configured to run with full autonomy, bypassing permission prompts for file writes and code execution via CLI flags (referenced in
SKILL.md).\n - Sanitization: The instructions rely on manual verification of worker output by the controller agent but do not specify any automated sanitization or input validation for data processed by the workers.
Audit Metadata