The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md explicitly direct the agent to launch workers using the codex command with the --dangerously-bypass-approvals-and-sandbox flag. This actively encourages the circumvention of built-in security controls, sandboxing, and user approval prompts for sub-tasks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize live data from tmux pane scrollback and Codex session logs (~/.codex/sessions/*.jsonl). This untrusted input stream, generated by external processes or other agents, creates an attack surface where malicious content could influence the manager agent.
Ingestion points: The scripts/lane_snapshot.py script captures tmux pane output and reads JSONL formatted logs; SKILL.md also suggests manual log inspection.
Boundary markers: No delimited sections or instructions to treat the ingested text as non-executable data are provided.
Capability inventory: The agent can run tmux commands, establish SSH tunnels, set GitHub repository secrets (gh secret set), and launch new shell processes.
Sanitization: While scripts/lane_snapshot.py attempts to redact secrets using regex, it provides no mechanism to filter prompt injection attempts within the captured content.
[CREDENTIALS_UNSAFE]: The helper script scripts/lane_snapshot.py includes a --show-content flag that, when used, disables all secret redaction logic. This allows sensitive information (such as API keys and tokens) present in terminal history or logs to be exposed in the snapshot output.
[COMMAND_EXECUTION]: The script scripts/lane_snapshot.py uses subprocess.run to execute tmux commands. While arguments are passed as a list, the script processes external strings like pane titles and log content, which could lead to command injection if misinterpreted by the agent or the underlying shell.

tmux-lane-orchestrator