dmux-workflows
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is built around executing shell commands to manage tmux panes and git worktrees. It specifically utilizes a
plan.jsonconfiguration that includes alauncherCommandfield, which serves as a template for shell command execution (e.g.,codex exec --cwd {worktree_path}).- [EXTERNAL_DOWNLOADS]: The instructions direct the user to install thedmuxorchestration tool globally via npm (npm install -g dmux) from an external GitHub repository (github.com/standardagents/dmux).- [INDIRECT_PROMPT_INJECTION]: The orchestration patterns create a surface for cross-agent instruction injection through shared files and handoff mechanisms. - Ingestion points: The agent context is populated by
plan.json, workerhandoff.mdfiles, and shared research outputs like/tmp/rate-limit-research.md. - Boundary markers: There are no explicit instructions for using delimiters or 'ignore embedded instructions' warnings when one agent consumes the output of another.
- Capability inventory: The skill possesses high-privilege capabilities including spawning shell processes via tmux and performing complex git operations.
- Sanitization: There is no evidence of sanitization or validation for the content generated by workers before it is ingested by subsequent agents in the workflow.
Audit Metadata