dmux-workflows
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONNO_CODE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to execute a local script via 'node scripts/orchestrate-worktrees.js' and defines a dynamic shell execution sink through the 'launcherCommand' field in JSON configuration files.
- [EXTERNAL_DOWNLOADS]: The documentation directs users to download and install the dmux tool from an external, non-whitelisted GitHub repository (github.com/standardagents/dmux).
- [PROMPT_INJECTION]: The skill's primary purpose is to chain multiple agent sessions, which creates a significant surface for indirect prompt injection. * Ingestion points: Data produced by one agent (e.g., research findings in /tmp/rate-limit-research.md or test failure summaries) is consumed by another agent. * Boundary markers: The workflow patterns do not include delimiters or instructions to ignore embedded commands in the processed data. * Capability inventory: The agents have the ability to execute shell commands, manage git worktrees, and write to the file system. * Sanitization: No sanitization or verification steps are defined for data passed between agent sessions.
- [NO_CODE]: The skill references several executable scripts (scripts/orchestrate-worktrees.js, scripts/lib/tmux-worktree-orchestrator.js, and scripts/orchestrate-codex-worker.sh) that are not provided within the skill bundle, preventing a full security audit of the actual execution logic.
Audit Metadata