The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use sudo to create a symbolic link in the /usr/local/bin/ directory, which requires administrative privilege escalation.
[REMOTE_CODE_EXECUTION]: The installation instructions include npx skills add manaflow-ai/cmux -g -y, which downloads and executes code from a remote package repository at runtime.
[EXTERNAL_DOWNLOADS]: The skill requires the addition of a third-party Homebrew tap (manaflow-ai/cmux) to install the application, introducing external code from a source outside of the pre-approved trusted list.
[COMMAND_EXECUTION]: The browser automation suite includes the browser eval command, which allows the execution of arbitrary JavaScript code within a browser surface.
[PROMPT_INJECTION]: The skill is highly vulnerable to Indirect Prompt Injection due to the following evidence chain:
Ingestion points: The agent reads untrusted data from external web pages via cmux browser snapshot and get text body, and from other terminal sessions using cmux read-screen.
Boundary markers: There are no instructions to use delimiters or ignore embedded instructions when processing this external content.
Capability inventory: The skill has the ability to send input to terminal panes (cmux send), create new execution environments, and perform browser automation.
Sanitization: The skill lacks any defined validation or filtering for the data ingested from external sources.

cmux