Skills spawn-agent

📦

spawn-agent

Name: spawn-agent
Author: Consiliency

Content revision r2 Critical 🔑 Env variables⚙️ External commands📁 Filesystem access

Spawn Coding Agents in New Terminals

Starting separate AI coding sessions across different CLIs requires platform-specific commands. This skill launches supported agents in new terminals and can capture their output.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "spawn-agent" from https://skillstore.io/skills/consiliency-spawn-agent.md and its manifest at https://skillstore.io/api/skills/consiliency-spawn-agent/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/consiliency-spawn-agent.md Signed manifest GET /api/skills/consiliency-spawn-agent/manifest Signed lockfile GET /api/skills/consiliency-spawn-agent/lockfile

Test it

Using "spawn-agent". Spawn Codex to review the current branch.

Expected outcome:

Opened a Codex session in a new terminal for the requested branch review.

Using "spawn-agent". Spawn Gemini with output capture to analyze the test failures.

Expected outcome:

Started the Gemini analysis and returned the temporary path for its saved response.

Using "spawn-agent". Check the captured agent response after completion.

Expected outcome:

Waited for the completion marker.
Returned the saved agent response.
Reported partial output when the timeout expired.

Security Audit

Critical

v12 • 7/23/2026 Open versioned report

The skill intentionally launches external CLI agents, and fork_terminal.py inserts command strings into platform shells without safe argument boundaries. Many documentation and keyword findings are false positives, but insecure temporary files and instructions to disable approval controls are confirmed. Publication should require safer defaults and hardened command and file handling.

Files scanned

1,381

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Critical

cookbook/claude-code.md:20-21 cookbook/codex-cli.md:44-46 cookbook/gemini-cli.md:48-50 cookbook/cursor-cli.md:40-43 cookbook/copilot-cli.md:20-28

Provider Safeguards Disabled by Default

The cookbooks direct agents to bypass approvals, sandboxes, or tool confirmations by default. Spawned agents can modify files and execute commands without review.

Multiple provider cookbooks explicitly require automatic approval or dangerous bypass flags. This is a consistent operating default, not an isolated example.

Capability review items (28)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical

fork_terminal.py:176

Python subprocess.run

subprocess.run(f"cmd.exe /c 'start cmd /k wsl -- {command}'", shell=True)

The function interpolates command directly into a cmd.exe string and invokes it with shell=True. Shell metacharacters can change the executed command.

Critical

fork_terminal.py:216

Python subprocess.Popen

subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)

wrapped_cmd includes command and is passed to Popen with shell=True. This is direct arbitrary shell execution without validation.

Critical

fork_terminal.py:222

Python subprocess.Popen

subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)

The debug branch passes a command-derived string to Popen with shell=True. Shell operators in command are executed with the skill process permissions.

Critical

fork_terminal.py:227

Python subprocess.Popen

subprocess.Popen(command, shell=True, cwd=cwd)

The raw command parameter is passed directly to Popen with shell=True. This is an explicit unrestricted command-execution path.

Critical

fork_terminal.py:176

Windows cmd.exe

subprocess.run(f"cmd.exe /c 'start cmd /k wsl -- {command}'", shell=True)

cmd.exe receives an interpolated command through shell=True. Command separators or quoting characters can alter the intended invocation.

High

fork_terminal.py:58

Python subprocess.run

subprocess.run(

The call executes AppleScript containing a shell command assembled from command and cwd. Those dynamic values are not safely escaped before Terminal executes them.

High

fork_terminal.py:93

Python subprocess.Popen

subprocess.Popen(wt_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

Although Popen receives an argument list, PowerShell receives a dynamic -Command string containing command and cwd. PowerShell will interpret untrusted metacharacters.

High

fork_terminal.py:161

Python subprocess.Popen

subprocess.Popen(wt_cmd)

This launches an executable temporary shell script whose body contains the unsanitized command. The argument list does not mitigate the script content.

High

fork_terminal.py:196

Python subprocess.Popen

subprocess.Popen(tmux_cmd)

The tmux argument list can invoke bash -c with wrapped_cmd, which contains the unsanitized command. This preserves shell interpretation of user-derived text.

High

fork_terminal.py:90

PowerShell invocation

"wt.exe", "-w", "new", "powershell.exe",

Windows Terminal starts PowerShell with a dynamic command string assembled from command and cwd. The string is not safely encoded for PowerShell.

High

fork_terminal.py:140

Unix shell invocation

script_content = f'''#!/bin/bash -li

The generated Bash script inserts command verbatim before execution. Any shell syntax in that value is active.

High

fork_terminal.py:146

Unix shell invocation

script_content = f'''#!/bin/bash -li

The debug script embeds command verbatim in a login shell. Output redirection does not limit the command's effects.

High

fork_terminal.py:152

Unix shell invocation

script_content = f'''#!/bin/bash -li

The no-log script still embeds and executes the command as unrestricted Bash source. No validation or argument boundary is present.

High

fork_terminal.py:137

Temp directory access

script_file = f"/tmp/fork-script-{output_id}.sh"

An executable script containing the command is placed in shared /tmp with a short identifier. Later non-exclusive writing creates symlink and disclosure risks.

High

fork_terminal.py:157

Python file write/append

with open(script_file, 'w') as f:

open(..., 'w') follows links and writes command-bearing script content to the shared temporary path. It does not use exclusive or no-follow creation.

High

fork_terminal.py:159

Python os file operations

os.chmod(script_file, 0o755)

The code makes the shared temporary script executable with mode 0755. This exposes command content and can affect a linked target if the path is compromised.

Medium

fork_terminal.py:41

Temp directory access

agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None

Agent responses are written under shared /tmp using a shortened UUID and ordinary shell redirection. The code does not enforce exclusive creation or private permissions.

Medium

fork_terminal.py:42

Temp directory access

debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None

Debug output may contain sensitive terminal data but uses a manually constructed shared temporary path. No private mode or secure creation is enforced.

Medium

fork_terminal.py:43

Temp directory access

done_file = f"/tmp/fork-output-{output_id}.done"

The completion marker uses a shared temporary path without exclusive creation. A local process that predicts the name can spoof completion or redirect touch.

Medium

fork_terminal.py:134

Temp directory access

agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None

The WSL agent-output path is manually created in shared /tmp and later written by tee. Secure creation and restrictive permissions are absent.

Medium

fork_terminal.py:135

Temp directory access

debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None

The WSL debug log uses shared /tmp and can retain full terminal output. The code does not create it exclusively with private permissions.

Medium

fork_terminal.py:136

Temp directory access

done_file = f"/tmp/fork-output-{output_id}.done"

This shared temporary completion marker can be pre-created to influence synchronization. The path lacks secure exclusive creation.

Medium

fork_terminal.py:183

Temp directory access

agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None

The tmux branch stores agent output in shared /tmp without guaranteed 0600 permissions or exclusive creation.

Medium

fork_terminal.py:184

Temp directory access

debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None

The tmux debug file can contain complete terminal output and is not securely created in a private directory.

Medium

fork_terminal.py:185

Temp directory access

done_file = f"/tmp/fork-output-{output_id}.done"

The tmux completion marker is created in shared /tmp without exclusive creation, allowing possible local spoofing.

Medium

fork_terminal.py:210

Temp directory access

agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None

The fallback branch stores agent output at an ordinary shared temporary path. The implementation does not enforce private access.

Medium

fork_terminal.py:211

Temp directory access

debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None

The fallback debug log uses a shared temporary file and may expose command output under common umask settings.

Medium

fork_terminal.py:212

Temp directory access

done_file = f"/tmp/fork-output-{output_id}.done"

The fallback completion marker is not created securely and can be spoofed if its shortened random identifier is predicted.

Risk Factors

🔑 Env variables (3)

cookbook/cursor-cli.md:128 cookbook/cursor-cli.md:148 fork_terminal.py:96

⚙️ External commands (33)

📁 Filesystem access (21)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/consiliency-spawn-agent/audits/12?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/consiliency-spawn-agent/security.svg)](https://skillstore.io/skills/consiliency-spawn-agent?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/consiliency-spawn-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/consiliency-spawn-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/consiliency-spawn-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Consiliency. (2026). spawn-agent security audit report (audit version 12) [Author version unspecified]. Skillstore. https://skillstore.io/skills/consiliency-spawn-agent/audits/12

BibTeX citation

@techreport{consiliency-consiliency-spawn-agent-2026,
  author = {Consiliency},
  title = {spawn-agent security audit report (audit version 12)},
  institution = {Skillstore},
  year = {2026},
  number = {12},
  url = {https://skillstore.io/skills/consiliency-spawn-agent/audits/12},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "spawn-agent security audit report (audit version 12)"
version: "unspecified"
type: report
authors:
  - name: "Consiliency"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/consiliency-spawn-agent/audits/12"
identifiers:
  - type: other
    value: "skillstore:consiliency-spawn-agent:audit:12"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Delegate a Focused Coding Task

Open a separate agent session to investigate a test failure while the main session continues.

Compare Provider Recommendations

Launch different coding agents with the same design question and compare their findings.

Capture an Automated Review

Run a non-interactive review and retrieve the saved response for a later workflow step.

Try These Prompts

Open a Basic Review Session

Spawn Claude Code in a new terminal. Ask it to review the current changes and summarize possible defects.

Investigate a Failing Test

Spawn Codex in a new terminal. Ask it to diagnose failures in [test path] and propose a focused fix.

Continue with Conversation Context

Spawn Gemini with a summary of our conversation. Ask it to evaluate [design decision] and list tradeoffs without editing files.

Capture a Constrained Analysis

Spawn Cursor in non-interactive mode with output capture. Limit its scope to [directory] and permit only [approved commands].

Best Practices

Review the generated command, working directory, and permission mode before launching an agent.
Use sandboxed, approval-based execution and grant only the tools required for the task.
Remove secrets from conversation summaries and delete captured output after use.

Avoid

Do not place API keys, tokens, or passwords in prompts or command-line arguments.
Do not disable sandbox and approval controls for routine tasks.
Do not treat a successful spawn as proof that the delegated task completed correctly.