The Agent Skills Directory

[PROMPT_INJECTION]: The instructions direct the agent to tell the user to "Allow-list tmux-cli once to avoid repeated approval prompts." This is an attempt to bypass the platform's security guardrails that require user confirmation for potentially dangerous CLI tool executions.
[COMMAND_EXECUTION]: The skill recommends using ssh -o StrictHostKeyChecking=no. This configuration disables host key verification, which is a critical security control to prevent man-in-the-middle (MITM) attacks during remote connections.
[UNVERIFIABLE_DEPENDENCIES]: The skill requires the installation of an external tool called claude-code-tools via uv tool install. This dependency is not part of the standard environment and its contents are not verified within the skill.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to capture and process output from tmux panes (tmux-cli capture), which can include data from untrusted remote SSH hosts.
Ingestion points: Data is ingested from tmux panes and remote shell environments (SKILL.md).
Boundary markers: No delimiters or safety instructions are provided to the agent to treat the captured output as untrusted data.
Capability inventory: The skill has the capability to execute commands (tmux-cli execute), send input to shells (send), and manage sessions.
Sanitization: There is no evidence of sanitization or filtering of the captured output before it is processed by the agent, creating a surface where a malicious remote shell could influence the agent's behavior via embedded instructions.

tmux-cli