The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to prefix a bash command with environment variables derived from the $ARGUMENTS field (e.g., MAESTRO_IMPL_AGENTS="<list>"). Because the instructions do not require the agent to sanitize or escape shell metacharacters within this input, a user could provide input designed to break out of the string literal and execute arbitrary commands (e.g., "; rm -rf /; #).
[DYNAMIC_EXECUTION]: The skill dynamically constructs and executes multiple shell commands and Node.js scripts at runtime using both user-provided arguments and output from an external local application (launch-ai-tools-manager-app.sh).
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface where untrusted data from user input and external process output is used to perform sensitive file and execution operations.
Ingestion points: The $ARGUMENTS variable and the JSON payload returned from the launch-ai-tools-manager-app.sh script (stdout).
Boundary markers: None specified for the interpolation of $ARGUMENTS or the processing of the form payload.
Capability inventory: File writing (.claude/maestro.json), shell execution via bash (launcher and validation scripts), and Node.js script execution (maestro-render-orchestrator.cjs, maestro-apply-rules.js).
Sanitization: No sanitization, escaping, or validation logic is defined for the untrusted inputs before they are used to build commands or write configuration files.

maestro-app