The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local bash script located at .specify/scripts/bash/check-prerequisites.sh to retrieve project paths and configuration.
[COMMAND_EXECUTION]: The skill implements a hook system (hooks.before_clarify and hooks.after_clarify) that triggers the execution of commands defined in the .specify/extensions.yml file.
[INDIRECT_PROMPT_INJECTION]: The hook system processes untrusted data from .specify/extensions.yml and uses it to generate commands for the agent to execute. If an attacker manages to place a malicious configuration file in the project, they could trigger arbitrary commands when the user invokes this skill.
Ingestion points: .specify/extensions.yml (hook definitions) and the feature specification file (specification content).
Boundary markers: The skill does not implement explicit delimiters or 'ignore' instructions for the hook-generated commands or the ingested spec content.
Capability inventory: The skill can trigger arbitrary slash commands via the EXECUTE_COMMAND directive, execute local shell scripts, and write updated content to the filesystem.
Sanitization: No sanitization or validation is performed on the commands retrieved from the extensions file or the content written to the spec file.

speckit-clarify