The Agent Skills Directory

[PROMPT_INJECTION]: The skill ingests untrusted external data from code files and wiki entries, which serves as a potential surface for indirect prompt injection.
Ingestion points: Target files are accessed via the Read tool, and wiki content is fetched using maestro wiki get or maestro search in SKILL.md.
Boundary markers: The skill does not define specific delimiters for parsed content, but it does enforce a strict output boundary to the .workflow/ directory.
Capability inventory: The execution environment has access to Bash, Write, Edit, Glob, Grep, and request_user_input tools.
Sanitization: There is no mention of sanitization or filtering of the content retrieved from external sources before analysis.
Mitigation: The skill includes a mandatory request_user_input gate (Invariant 6) that requires the user to review and confirm findings before any persistence occurs.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute maestro CLI commands for fetching wiki entries and performing searches.
Evidence: This logic is implemented in Stage 1 and Stage 5 of the execution flow to resolve targets and optionally save notes back to the wiki. This behavior is considered safe as it is central to the skill's documented functionality and is protected by user confirmation gates.

learn-follow