cmux-cli
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
cmuxcommand-line utility to manage terminal workspaces, panels, and input. These commands are restricted to the local environment and are consistent with the skill's documented purpose of terminal management. - [INDIRECT_PROMPT_INJECTION]: The skill ingests JSON output from tool commands (e.g.,
cmux identify --json,cmux list-panels --json) to resolve workspace and surface IDs. While this constitutes an attack surface for data-driven instructions, the risk is mitigated by explicit instructions to verify state changes with independent queries and the focus on observable behavior. - [EXTERNAL_DOWNLOADS]: The skill contains a reference link to official documentation at
https://cmux.com/pt-BR/docs/api. This is a legitimate vendor-owned resource for thecmuxtool and does not involve automated downloads, package installations, or remote code execution.
Audit Metadata