The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local scripts (scripts/orchestrate-worktrees.js and scripts/orchestrate-codex-worker.sh) to automate the creation of tmux panes and launch agent sessions. These scripts use template-based command construction (e.g., codex exec --cwd {worktree_path} --task-file {task_file}) which can be vulnerable to command injection if the variables are populated from unsanitized external data.
[EXTERNAL_DOWNLOADS]: The documentation encourages the installation of dmux from a third-party GitHub repository (github.com/standardagents/dmux). Although it includes a disclaimer for user review, this represents a potential supply chain risk as the tool is necessary for the skill's primary functionality but resides outside of verified organization namespaces.
[PROMPT_INJECTION]: An indirect prompt injection surface exists in the orchestration workflow. The plan.json file defines the task strings that are passed to sub-agents. If an attacker can influence this file—such as via a malicious pull request—they could inject instructions that the parallel agents would then follow with the full context and capabilities of those harnesses.
Ingestion points: plan.json (task descriptions and launcher commands).
Boundary markers: Absent; the skill does not specify the use of delimiters or 'ignore' instructions for the sub-agent tasks.
Capability inventory: The sub-agents mentioned (Claude Code, Codex, Cline) typically have extensive file system and shell execution capabilities.
Sanitization: No sanitization or validation of the task descriptions or command templates is mentioned in the workflow documentation.

dmux-workflows