maestro-collab
Warn
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill dynamically constructs shell commands for the maestro delegate CLI tool by interpolating the user-supplied requirement argument into the command string executed via exec_command. This pattern is susceptible to command injection if the requirement text contains shell metacharacters such as semicolons, backticks, or pipes. Note: the exec_command tool is not listed in the frontmatter allowed-tools field, which may restrict the skill's ability to execute this logic in strictly configured environments.- [PROMPT_INJECTION]: The workflow exhibits an indirect prompt injection surface (Category 8). The agent reads and processes raw output from multiple external CLI tools to perform cross-verification and synthesis. \n
- Ingestion points: Raw outputs from maestro delegate stored in scratch directories and project context files (@**/*). \n
- Boundary markers: Absent; the skill does not define delimiters or ignore instructions for the aggregated CLI data. \n
- Capability inventory: Uses exec_command, Write, Edit, and maestro spec add for report generation and artifact registration. \n
- Sanitization: None; the skill explicitly instructs the agent to save raw CLI output verbatim and then process it directly for synthesis, which could allow malicious instructions in analyzed files to influence the coordinator's behavior.
Audit Metadata