The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external issue trackers (such as issue titles, context, and feedback) which may contain malicious instructions. This data is propagated through the pipeline to roles with write capabilities.
Ingestion points: External data is loaded in roles/explorer/role.md via the maestro issue status command.
Boundary markers: Untrusted content is interpolated into agent prompts without using delimiters or 'ignore instructions' warnings to prevent the model from following embedded commands.
Capability inventory: The implementer role has Bash access and the ability to modify the codebase via maestro delegate --mode write.
Sanitization: There is no evidence of validation or sanitization of external strings before they are used in agent prompts.
[COMMAND_EXECUTION]: The skill constructs shell commands using untrusted variables, which could lead to command injection.
Evidence: In roles/explorer/role.md, the <issue.title> variable is interpolated directly into a Bash command for maestro delegate. A crafted issue title containing shell metacharacters (e.g., quotes, semicolons) could execute arbitrary commands in the host environment.
[DYNAMIC_EXECUTION]: The coordinator role dynamically constructs and spawns sub-agents at runtime, incorporating task-specific data into their system instructions.
Evidence: SKILL.md and roles/coordinator/commands/monitor.md use the Agent tool to spawn team-worker agents with prompts generated from templates using runtime variables.

team-issue