The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input provided via arguments and propagates it through a multi-stage workflow.
Ingestion points: Untrusted feature descriptions, bug reports, or ideas enter the skill through the $ARGUMENTS variable at the beginning of the workflow.
Boundary markers: While the input is initially encapsulated in <feature_description> tags, it is subsequently interpolated into the prompts for sensitive sub-tasks, such as majestic-engineer:plan:architect and various research agents, without robust delimitation or instructions to ignore embedded commands.
Capability inventory: The workflow possesses significant capabilities, including modifying the filesystem (Edit on AGENTS.md), executing shell commands (Bash for plan previews), and creating/updating tasks.
Sanitization: There is no evidence of sanitization, filtering, or escaping applied to the user-provided text before it influences the behavior of downstream LLM-driven components.
[COMMAND_EXECUTION]: The skill invokes a shell command to open generated documents, which could be exploited if the file path is manipulated.
Evidence: The skill uses Bash(command: "open {plan_path}") to provide a preview of the generated plan.
The {plan_path} includes a title derived from the user-provided feature description. If the system does not strictly sanitize the strings used to generate filenames, an attacker could attempt to inject shell metacharacters into the description to influence the execution of the open command.

blueprint