maestro-impeccable
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to execute shell commands for managing theimpeccableCLI (e.g.,npx impeccable install,npx impeccable update) and Maestro-specific lifecycle operations (e.g.,maestro run complete). - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
impeccabletool from the npm registry using thenpxcommand when local resolution fails or a manual update is requested. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from project files and user instructions, creating a vulnerability surface for indirect prompt injection. \n
- Ingestion points: The skill reads project-level context from
PRODUCT.md, existing source code files, and user-supplied UI requirements. \n - Boundary markers: The skill employs a structured communication protocol using Maestro-specific symbols (
→,✓,◆) and requires the creation of a formalreport.mdartifact to maintain task state. \n - Capability inventory: The skill is granted access to high-privilege tools including
Bash,Write,Edit,Read, andspawn_agent. \n - Sanitization: Security is enforced through defined verification steps (e.g.,
confirmation pass 1/1) and mandatory human-in-the-loop confirmation gates (◆ GATE) before finalizing design changes. - [DYNAMIC_EXECUTION]: The skill dynamically routes execution and loads specific markdown reference files (e.g.,
reference/routing.md,reference/craft-floor.md,ui-codify.md) from the local file system based on user-supplied arguments and detected project state.
Audit Metadata