The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands via the Bash tool that include user-supplied input from $ARGUMENTS. Specifically, in Step 2 (maestro wiki get <entry-id>) and Step 4 (maestro wiki remove-entry <entry-id>), the <entry-id> is interpolated directly into the command string. If the agent does not perform strict sanitization, an attacker could provide an ID containing shell metacharacters or command substitutions (e.g., $(id)) to execute arbitrary code.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) due to the following factors:
Ingestion points: Untrusted data enters the context via the $ARGUMENTS (entry ID) and the content of the spec entries read from .workflow/specs/ during Step 2.
Boundary markers: The instructions do not define delimiters or provide warnings to the agent to ignore instructions that might be embedded within the spec entries being processed.
Capability inventory: The skill utilizes the Bash tool for command execution and Write/Edit tools for file system modifications (including cascading deletions in Step 4).
Sanitization: There is no explicit requirement for the agent to validate or sanitize the entry ID or the retrieved file content before use.

spec-remove