maestro-fork
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses the Bash tool to execute standard git operations such as 'git worktree add' and 'git merge'. These commands are consistent with the skill's stated purpose of enabling parallel development across milestones.
- [SAFE]: File access is limited to the project's local directory and the user's home configuration directory (~/.maestro/). This is used for reading internal templates and workflow definitions required for the skill's operation.
- [SAFE]: No network exfiltration patterns, hardcoded credentials, or obfuscated content were found. The skill does not attempt to download or execute code from external or untrusted sources.
- [SAFE]: The skill ingests user input via $ARGUMENTS for milestone numbers and branch names. While this presents a surface for indirect prompt injection if a user provides shell meta-characters, the risk is negligible in a local developer tool context where the agent is acting as an assistant to the user, and the behavior is fundamental to the skill's primary utility.
Audit Metadata