capture
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill constructs file paths using a user-controllable 'topic' argument to save session records (e.g.,
.maestro/sessions/{date}_{topic}.md). This pattern can lead to path traversal vulnerabilities if the user-provided topic contains characters like../, potentially allowing the agent to write files outside of the intended directory. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and summarize the current conversation history, which constitutes untrusted input.
- Ingestion points: The conversation history is read globally to identify commands, decisions, and changes.
- Boundary markers: The instructions do not define clear boundaries or specify that the agent should ignore instructions embedded within the conversation history being summarized.
- Capability inventory: The skill possesses the capability to write new files and append to existing JSONL files in the
.maestro/directory. - Sanitization: There is no explicit requirement for the agent to sanitize or escape the content extracted from the conversation history before writing it to the filesystem.
Audit Metadata