The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to 'harvest', 'stage', and 'promote' knowledge derived from session artifacts and other external inputs. This ingestion of potentially untrusted data creates a surface for indirect prompt injection attacks.
Ingestion points: The skill processes user-supplied intents in $ARGUMENTS, session artifacts during the harvest phase, and candidate content during the stage phase.
Boundary markers: The instructions do not define explicit delimiters or 'ignore embedded instructions' warnings for the data being harvested, which may lead the agent to follow instructions contained within the knowledge data.
Capability inventory: The skill is granted high-privilege tools, including Bash (shell execution), Edit and Write (filesystem modification), WebFetch (network access), and spawn_agent/spawn_agents_on_csv (orchestration of additional agents).
Sanitization: The skill includes a mitigation note advising the agent to use --content-file instead of inline positional content to prevent shell misparsing and potential command injection.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute maestro knowledge CLI commands based on user intent classification. While the command structure is defined, the dynamic nature of intent classification could lead to the execution of unintended tool commands if the classification logic is manipulated by an attacker via the intent string.

maestro-knowledge