The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and processing untrusted data to guide its decision-making and command generation processes.
Ingestion points: User-provided intent in $ARGUMENTS, project-specific state files in .workflow/, and the results of filesystem discovery tools like Glob and Grep (e.g., in A_DECOMPOSE_TASKS).
Boundary markers: There are no explicit instructions or delimiters defined to isolate untrusted content from the internal decision logic within the prompt construction steps.
Capability inventory: The skill has access to powerful tools such as Bash, Write, and Edit, which are orchestrated based on the processed inputs.
Sanitization: The skill does not specify any validation or sanitization routines for external data before interpolating it into prompts for delegate evaluation.
[COMMAND_EXECUTION]: The skill dynamically constructs and delegates shell command sequences through a structured lifecycle management system.
The A_BUILD_STEPS routine generates execution chains that are ultimately processed by the maestro CLI and the maestro-ralph-execute skill.
Project-level skill overrides (located in .codex/skills/) allow the orchestrator to load and execute local configurations, creating a vector for command injection if the project environment contains malicious skill definitions which the orchestrator then triggers.

maestro-ralph