tmux-lane-orchestrator
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted data from live tmux pane captures and Codex logs, creating an attack surface for indirect prompt injection where malicious terminal output could influence the agent. \n
- Ingestion points: The
scripts/lane_snapshot.pyscript captures terminal scrollback and reads.jsonlsession logs from~/.codex/sessions.\n - Boundary markers: The instructions lack explicit delimiters or instructions to isolate the captured terminal content from the agent's operating rules.\n
- Capability inventory: The agent can execute shell commands, manage files, and launch un-sandboxed sub-agents.\n
- Sanitization: While the skill redacts secrets like API keys for display, it does not sanitize for malicious instructions within the captured content.\n- [COMMAND_EXECUTION]: Uses the
tmuxCLI for state management and capture. It also explicitly instructs the agent to launch sub-workers using thecodextool with the--dangerously-bypass-approvals-and-sandboxflag, which disables safety guardrails and filters for those processes.\n- [EXTERNAL_DOWNLOADS]: Facilitates network operations by establishing SSH tunnels for port forwarding (ssh -L) to make remote preview ports reachable, involving network connectivity to hosts provided by the user or environment.
Audit Metadata