maestro
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes git commands for worktree and branch management, and invokes shell-based test runners (such as npm test, cargo test, or pytest) identified within the target repository.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It parses external planning documents (plans, PRDs, ADRs) to extract file paths that define the scope for sub-agents. A malicious document could include sensitive system paths, potentially tricking sub-agents into unauthorized file access.
- Ingestion points: Markdown planning documents processed by scripts/extract_files.py.
- Boundary markers: Orchestration instructions attempt to scope sub-agents to the extracted file list, but the contents of that list are untrusted.
- Capability inventory: Spawning new agents with modification privileges and executing test commands.
- Sanitization: The parser excludes URLs but lacks validation for absolute paths or directory traversal strings.
Audit Metadata