The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local bash script located at .specify/scripts/bash/check-prerequisites.sh during the initialization phase to verify the project state.
[INDIRECT_PROMPT_INJECTION]: The skill reads .specify/extensions.yml to identify and execute 'hooks' (pre-execution and post-reporting). A malicious actor with write access to the repository could modify this file to force the agent to execute arbitrary slash commands via the EXECUTE_COMMAND directive.
[INDIRECT_PROMPT_INJECTION]: The skill ingests content from several local files (spec.md, plan.md, tasks.md, and constitution.md) for semantic modeling and analysis. Malicious instructions embedded in these artifacts could potentially bias the analysis or influence the generated report.
[INDIRECT_PROMPT_INJECTION]: Evidence Chain for Category 8:
Ingestion points: .specify/extensions.yml, spec.md, plan.md, tasks.md, and .specify/memory/constitution.md.
Boundary markers: None. Content from artifacts is loaded directly into the context for building semantic models.
Capability inventory: The skill can execute local shell scripts (.specify/scripts/bash/check-prerequisites.sh) and trigger other agent commands using the EXECUTE_COMMAND syntax.
Sanitization: No explicit sanitization or instruction-filtering is performed on the ingested content before processing.

speckit-analyze