tmux-lane-orchestrator

Pass

Audited by Gen Agent Trust Hub on Jul 29, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill ingests untrusted data from live tmux pane captures and Codex logs, creating an attack surface for indirect prompt injection where malicious terminal output could influence the agent. \n
  • Ingestion points: The scripts/lane_snapshot.py script captures terminal scrollback and reads .jsonl session logs from ~/.codex/sessions.\n
  • Boundary markers: The instructions lack explicit delimiters or instructions to isolate the captured terminal content from the agent's operating rules.\n
  • Capability inventory: The agent can execute shell commands, manage files, and launch un-sandboxed sub-agents.\n
  • Sanitization: While the skill redacts secrets like API keys for display, it does not sanitize for malicious instructions within the captured content.\n- [COMMAND_EXECUTION]: Uses the tmux CLI for state management and capture. It also explicitly instructs the agent to launch sub-workers using the codex tool with the --dangerously-bypass-approvals-and-sandbox flag, which disables safety guardrails and filters for those processes.\n- [EXTERNAL_DOWNLOADS]: Facilitates network operations by establishing SSH tunnels for port forwarding (ssh -L) to make remote preview ports reachable, involving network connectivity to hosts provided by the user or environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 29, 2026, 02:50 AM
Security Audit — agent-trust-hub — tmux-lane-orchestrator