The Agent Skills Directory

[COMMAND_EXECUTION]: The skill leverages standard local CLI tools including git, grep, and cat to analyze the repository history and file contents. It also executes a user-provided test runner command to validate the implementation against architectural and contract requirements. These commands are executed within the context of the local repository being audited.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted data from specification files (spec.md, plan.md) and git diffs. Ingestion points: files within the 'kitty-specs/' directory and repository diffs. Boundary markers: None explicitly defined. Capability inventory: execution of git, grep, cat, and local test runners. Sanitization: No explicit sanitization or escaping of external content is mentioned. The risk is mitigated by the skill's strict requirement for a structured, evidence-based review process that anchors all findings to git artifacts.
[DATA_EXFILTRATION]: No unauthorized network operations or exfiltration patterns were identified. The skill incorporates a 'SAAS_SYNC' environment variable for specific testing gates, which is consistent with its intended function of validating synchronization logic in the 'Spec Kitty' platform. The security review section of the skill is designed to find and report risks in the user's code, not to perform malicious actions.

spec-kitty-mission-review