The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute maestro ralph next --session {session_id}. The session_id variable is extracted directly from the $ARGUMENTS provided in the delegation prompt. This pattern of shell execution with variable interpolation can be exploited if the underlying CLI does not perform strict validation of the session identifier.
[PROMPT_INJECTION]: The skill implements an indirect execution pattern where it accepts a skill_name and skill_args from an untrusted external source ($ARGUMENTS) and executes them using the Skill() abstraction. This creates a surface for indirect prompt injection (Category 8).
Ingestion points: Data enters the agent context via the $ARGUMENTS variable in the S_PARSE state.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are applied to the arguments before they are passed to the execution action.
Capability inventory: The skill has access to the Bash tool, file system operations (Read, Write, Edit, Glob), and the ability to trigger any other skill in the environment via the Skill() function.
Sanitization: There is no validation, filtering, or allow-listing of the skill_name against a known-safe list before the execution step occurs.

maestro-ralph-cli-execute