tmux-worktree-session
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and interprets data from potentially untrusted files in a repository to determine its actions.
- Ingestion points: Local repository files used for discovery, such as
bin/worktree,DEVSTACK.md,README.md,.mise.toml, and.tool-versions(documented in the discovery cheatsheet). - Boundary markers: Absent; instructions do not specify using delimiters or 'ignore embedded instructions' warnings when parsing these files.
- Capability inventory: The skill can execute arbitrary shell commands in tmux panes, perform git worktree operations, and launch additional AI agents.
- Sanitization: Absent for repository data ingestion; however, the skill explicitly instructs the agent to surface secret prompts to the user rather than handling credentials itself.
- [COMMAND_EXECUTION]: The skill performs extensive shell command execution to orchestrate tmux sessions and git worktrees. It actively searches for and runs local scripts like
bin/worktree,bin/dev, and test runners (rspec,pytest, etc.). While this is the primary purpose of the skill, the execution of arbitrary scripts found in the repository carries inherent risk if the repository contains malicious configuration.
Audit Metadata