The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically constructs shell commands by interpolating data from issue reports, including titles and IDs, which are then executed using the Bash tool. This pattern is prevalent in the exploration and implementation phases.
Evidence: In roles/explorer/role.md, the skill builds an exploration prompt template that includes <issue.title> and passes it to Bash("maestro delegate ..."). A similar pattern for command routing exists in roles/implementer/role.md.
Evidence: The coordinator in roles/coordinator/role.md generates session IDs from issue slugs and uses them in Bash("mkdir -p ...") calls.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes external issue descriptions and injects them into the prompts of sub-agents and CLI tools without adequate isolation.
Ingestion points: External data is ingested via ccw issue status in roles/explorer/role.md and ccw issue list in roles/coordinator/role.md.
Boundary markers: There are no explicit boundary markers or instructions to ignore potential commands embedded in the issue text when it is passed to the workers.
Capability inventory: The skill possesses high-privilege capabilities, including arbitrary command execution (Bash), filesystem modifications (Write, Edit), and the ability to spawn further agents (Agent).
Sanitization: No sanitization, escaping, or validation logic is applied to the issue metadata before it is used to drive the orchestration logic.

team-issue