The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to interpolate user-provided strings (like task descriptions, intent text, and keywords) directly into shell commands for tools such as maestro load, maestro search, and maestro-next. If the input contains shell metacharacters, it could lead to unintended command execution.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) because it reads and processes companion documents that contain user-supplied notes and insights.
Ingestion points: Companion documents stored in .workflow/.scratchpad/ are read during the after mode for review and promotion.
Boundary markers: The instructions do not define clear delimiters or instruction-override protections when the agent reads the companion document content.
Capability inventory: The skill is granted Bash, Write, Edit, and request_user_input capabilities, and it has the authority to trigger other skills.
Sanitization: There is no evidence of content sanitization or validation performed on the entries before they are parsed and promoted to other system areas.

maestro-companion