The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill is instructed to run a shell script located at .specify/scripts/bash/check-prerequisites.sh from the repository root. Since this script is part of the project being analyzed rather than the skill itself, it allows code provided by an untrusted source to execute on the user's system.- [COMMAND_EXECUTION]: The skill dynamically constructs and triggers commands (hooks) based on the contents of .specify/extensions.yml. It specifically uses the EXECUTE_COMMAND directive for mandatory hooks, which bypasses manual user invocation for commands defined by the repository data.- [INDIRECT_PROMPT_INJECTION]: The skill's execution logic is heavily driven by untrusted data from the project repository, creating a significant attack surface for indirect injection.
Ingestion points: .specify/extensions.yml, tasks.md, and files within the checklists/ directory.
Boundary markers: No delimiters or safety instructions are used to isolate the instructions found in these external files from the agent's core logic.
Capability inventory: The skill can execute shell scripts, trigger other agent commands via slash-command syntax, and perform file system modifications (creating/updating ignore files and task lists).
Sanitization: There is no evidence of sanitization or validation for the hook commands or task descriptions before they are interpreted or executed.

speckit-implement