The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and follows instructions from external markdown files found in the user's home directory (~/.maestro/workflows/updates/update-v{target}-setup.md). This creates a vulnerability surface where an attacker who can modify files in the user's home directory could influence the agent's behavior during an update.
Ingestion points: Content from version-specific setup documents (update-v*-setup.md) and version metadata in .workflow/state.json.
Boundary markers: Absent. The instructions explicitly tell the agent to "follow that document completely."
Capability inventory: The skill allows the execution of Bash commands, file writing, and editing.
Sanitization: None. The skill does not validate the content of the loaded setup documents before following the instructions within them.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local CLI tool (maestro update --migrate). Error documentation (E002) indicates this tool relies on npx tsx, which involves executing Node.js scripts via the npm package runner.
[DYNAMIC_EXECUTION]: The skill dynamically determines which instructions to follow at runtime based on the detected version number and the presence of setup files in the ~/.maestro/ directory. While these files are local, they function as dynamic logic extensions for the agent's update process.

maestro-update