The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands constructed by interpolating variables that contain data returned from external tool outputs. Evidence: In action A_MARK_COMPLETE, the skill runs Bash("maestro ralph complete ... --summary \"{SUMMARY}\" ..."). Evidence: In action A_DISPATCH_DELEGATE, it runs maestro delegate \"{prompt}\" .... Concern: If the interpolated variables (like {SUMMARY} or {prompt}) contain shell metacharacters such as semicolons, backticks, or redirectors, they can escape the command context and execute arbitrary shell commands on the host system.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8). Ingestion points: The skill reads project-specific artifact files like conclusions.json, review.json, and TASK-*.json to build context for the next step (File: SKILL.md, Action: A_LOAD_STEP_CONTEXT). Capability inventory: The orchestrator has access to high-privilege tools including Bash, Write, and Edit. Boundary markers: There is no evidence of using XML delimiters or instructions to ignore embedded commands when wrapping this untrusted external data. Sanitization: The skill lacks logic to escape or validate data before interpolating it into prompts for subsequent tool execution in the loop (Action: A_COMPOSE_DELEGATION_PROMPT).

maestro-ralph-cli