The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill requires administrative access via the sudo command to create symbolic links for the CLI binary in /usr/local/bin.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill instructs the installation of software and skills from external, non-trusted repositories using brew tap and npx skills add.
[COMMAND_EXECUTION]: The cmux send and cmux send-key commands allow the agent to inject arbitrary shell commands and keystrokes into any managed terminal surface.
[DYNAMIC_EXECUTION]: The cmux browser eval command facilitates the execution of arbitrary JavaScript code within browser surfaces.
[INDIRECT_PROMPT_INJECTION]: The skill presents a significant vulnerability surface for indirect prompt injection:
Ingestion points: Terminal output is ingested via cmux read-screen and web content via cmux browser snapshot.
Boundary markers: Absent. There are no instructions or delimiters to isolate untrusted external content.
Capability inventory: The agent can execute system commands, run JavaScript, and modify configuration files.
Sanitization: Absent. External content is interpolated into the context without escaping or validation.
[PERSISTENCE_MECHANISMS]: The cmux hooks setup command facilitates persistent agent integration within user shell environments.

cmux