The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests arbitrary user intent through the $ARGUMENTS variable and passes it to a workflow capable of executing shell commands and modifying files.
Ingestion points: The skill captures the entire user-provided intent (e.g., code templates, decisions, tips) in the $ARGUMENTS parameter as seen in the dispatch section.
Boundary markers: There are no explicit instructions to use delimiters (like triple backticks or XML tags) or boundary markers to isolate the untrusted user input from the system instructions.
Capability inventory: The skill has access to powerful tools including Bash, Write, Edit, and Read, which could be abused if the input contains malicious payloads.
Sanitization: The instructions do not define any sanitization, escaping, or validation logic for the $ARGUMENTS before they are passed to the maestro CLI or the underlying workflow.
[DYNAMIC_EXECUTION]: The skill utilizes dynamic instruction loading, where the actual logic is retrieved from a file external to the skill's source.
Pattern: The dispatch section instructs the agent to "Read ~/.maestro/workflows/knowhow.md and follow the execution document directly." This means the agent's behavior is determined by a file located in the user's home directory, which could be modified by other local processes or scripts, leading to non-static and potentially untrusted execution logic.

maestro-knowhow