The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it is designed to ingest and analyze untrusted external data.
Ingestion points: The follow, investigate, decompose, and consult subcommands all ingest content from user-specified file paths, wiki entries, and search results using the Read tool.
Boundary markers: The instructions do not define explicit delimiters or 'ignore embedded instructions' warnings when passing the content of read files into the LLM context for analysis (e.g., during the 'forcing questions' phase).
Capability inventory: The skill has access to powerful capabilities including the Bash tool for command execution, Write for file modification, and spawn_agent for orchestration.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the external content before it is processed by the agent's logic. Malicious instructions embedded in analyzed code could potentially influence the agent's actions during the understanding or investigation phases.
[COMMAND_EXECUTION]: The skill is granted access to the Bash tool. While the instructions specify that file writes should be restricted to the .workflow/ directory and source code should remain read-only, the presence of the Bash tool allows for arbitrary command execution within the agent's environment. The execution logic uses this for context building and dependency tracing (e.g., git log), which is consistent with the stated purpose.

maestro-learn