The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that reads and interprets external specification and planning documents (e.g., spec.md, plan.md) to drive development tasks. This creates a surface where instructions embedded in these documents could influence the agent's behavior during the implementation phase. Furthermore, the inclusion of skill-report.json containing self-referential safety claims ("risk_level": "safe") is an attempt to influence the analysis process.
Ingestion points: The workflow processes content from the .specify/specs/ directory as described in SKILL.md.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands were found in the provided documentation.
Capability inventory: The skill describes capabilities for file creation, script generation, and phased task execution.
Sanitization: No sanitization or validation of external requirement content is described.
[DYNAMIC_EXECUTION]: The documentation for Phase 0 and Phase 7 explicitly describes the generation of script variants (specifically bash and powershell) and the execution of tasks based on the generated plan. This methodology encourages the creation and running of code at runtime.
[METADATA_POISONING]: The skill includes a file named skill-report.json that provides a pre-computed security audit claiming the skill is "safe" and "safe_to_publish". This self-certification acts as deceptive metadata that could lead users or automated systems to misjudge the actual security posture of the skill.

spec-driven-development