The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains a vulnerability surface for indirect prompt injection by relaying unsanitized user input to subsequent commands.
Ingestion points: User-provided intent text and flags are ingested from the $ARGUMENTS context in SKILL.md.
Boundary markers: Absent. The skill does not use delimiters or specific instructions to the agent to ignore embedded commands within the user-supplied intent string.
Capability inventory: The skill is authorized to use Bash and can invoke other skills within the agent's execution context.
Sanitization: There is no logic present to sanitize, escape, or validate the intent string before it is passed as a raw argument to the recommended skill in the A_INVOKE_SKILL action.
[COMMAND_EXECUTION]: The skill executes local system commands to discover its configuration and available modules.
Evidence: The A_RESOLVE_COMMAND_PATH action executes maestro ralph skills --platform codex --json --quiet to dynamically build its routing table from the local environment.

maestro-next