spawn
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
tmuxto execute shell commands that launch additional instances of theclaudeCLI. This is an intended feature to allow parallel task execution in separate terminal windows or panes. - [CREDENTIALS_UNSAFE]: The instructions explicitly forbid the inclusion of secrets, keys, tokens, or credentials in the briefing files generated for spawned sessions, which is a positive security practice.
- [PROMPT_INJECTION]: The skill manages the flow of information between agent sessions by writing briefings to local markdown files (
docs/spawn/<slug>.md). It includes logic to prevent session collisions by defining 'collision zones' and explicitly asks the user for the permission mode (--dangerously-skip-permissionsor--permission-mode auto) before execution. While the briefing file serves as an ingestion point for instructions to the new session, the workflow is user-initiated and follows standard project management patterns.
Audit Metadata