The Agent Skills Directory

[COMMAND_EXECUTION]: The skill takes input from $ARGUMENTS to construct a shell command: maestro timeline --since <resolved_date> --json --output <sessionFolder>/timeline.json. The <resolved_date> is directly derived from the user-provided --since flag. If this input is not sanitized by the execution environment, it allows for arbitrary command injection via shell metacharacters.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes external, untrusted content from the codebase and .workflow/ documentation. In deep mode, it uses LLM-based sub-agents to perform semantic analysis on this content, which could be manipulated to return false findings or influence the orchestrator's actions.
Ingestion points: Reads content from .workflow/specs/*.md, .workflow/codebase/*.md, .workflow/roadmap.md, .workflow/issues/issues.jsonl, and source code files.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present when content is passed to scanners.
Capability inventory: The orchestrator can execute Bash commands and perform Write and Edit operations on project metadata files and backups.
Sanitization: No evidence of sanitization or validation of the content read from the project files before processing.

manage-drift-realign