The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes project-level configuration and template files that could contain malicious instructions designed to hijack the agent's logic during the constitution update process.
Ingestion points: .specify/extensions.yml, .specify/memory/constitution.md, and various files in .specify/templates/.
Boundary markers: The instructions lack explicit delimiters or safety warnings to ignore instructions embedded within the ingested files.
Capability inventory: The skill has the ability to read multiple files across the repository, overwrite the constitution file, and trigger external commands via the EXECUTE_COMMAND directive.
Sanitization: No validation or sanitization of the input fields from the extension YAML or template files is performed before they are used to generate output or trigger actions.
[DYNAMIC_EXECUTION]: The skill uses a hook system that reads command names from .specify/extensions.yml and instructs the agent to execute them via the EXECUTE_COMMAND keyword. This allows the state of the repository to dynamically control which tools or skills the agent invokes.
[COMMAND_EXECUTION]: The skill instructions explicitly direct the agent to run commands specified in the mandatory pre-hooks and post-hooks defined in the project's configuration file.

speckit-constitution