The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by interpolating variables containing user-controlled or untrusted data into strings passed to the Bash tool. This pattern is prevalent in the following files:
In roles/coordinator/commands/roadmap-discuss.md, the projectGoal variable (directly from user input) is embedded in a maestro delegate command.
In roles/planner/role.md, the phaseGoal and contextMd variables are interpolated into maestro delegate commands.
In roles/executor/role.md, the description, implementationSteps, and convergenceCriteria variables (parsed from generated JSON files) are interpolated into maestro delegate commands.
The presence of shell metacharacters in these variables could lead to arbitrary command execution on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture creates a significant surface for indirect prompt injection and data flow attacks.
Ingestion points: The initial taskDescription provided by the user and the subsequent projectGoal and phaseGoal derived from it act as untrusted entry points.
Boundary markers: No explicit boundary markers or sanitization logic are present to prevent embedded instructions or shell-sensitive characters from altering the intended command execution.
Capability inventory: The skill possesses extensive permissions including Bash (shell access), Write/Edit (file system modification), and Agent (sub-agent spawning), which can be manipulated if an injection is successful.
Sanitization: There is no evidence of input validation, escaping, or filtering before data is used in shell commands or passed between specialized roles.

team-roadmap-dev