The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from various configuration files within the workspace, creating a surface for indirect injection.
Ingestion points: Reads .specify/extensions.yml, .specify/init-options.json, and .specify/templates/spec-template.md from the project root.
Boundary markers: Absent. The skill does not use delimiters or instructions to prevent the agent from obeying commands embedded within these files.
Capability inventory: Includes mkdir -p, cp, and the EXECUTE_COMMAND trigger which can invoke other agent tools.
Sanitization: None. The skill does not validate or sanitize values from the YAML or JSON files before using them to construct commands or determine execution flow.
[DYNAMIC_EXECUTION]: The skill implements a dynamic hook system that triggers other agent tools based on external configuration.
It extracts command names from the hooks.before_specify and hooks.after_specify keys in .specify/extensions.yml.
These names are used with the EXECUTE_COMMAND directive, allowing the project configuration to control which agent skills are executed during the specification process.
[COMMAND_EXECUTION]: The skill performs file system modifications using paths derived from project configuration and user input.
It executes mkdir -p and cp operations using the SPECIFY_FEATURE_DIRECTORY variable.
The value of SPECIFY_FEATURE_DIRECTORY is partially determined by the branch_numbering setting in .specify/init-options.json, which could be manipulated to target unexpected directory paths.

speckit-specify