The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local bash script located at .specify/scripts/bash/setup-tasks.sh during the Setup phase. This script is part of the repository being analyzed, allowing a malicious repository to execute arbitrary code on the user's system.
[DYNAMIC_EXECUTION]: The skill implements a hook system that reads commands from .specify/extensions.yml and instructs the agent to run them using the EXECUTE_COMMAND instruction. This allows for the dynamic assembly and execution of commands based on external project configuration.
[INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data to drive its core logic and execution flow, creating an attack surface where malicious input in repository files can influence agent behavior. 1. Ingestion points: .specify/extensions.yml, plan.md, spec.md, and the output of .specify/scripts/bash/setup-tasks.sh. 2. Boundary markers: None are present to distinguish between trusted instructions and untrusted data from the repository. 3. Capability inventory: Shell command execution (via bash script) and tool invocation (via EXECUTE_COMMAND). 4. Sanitization: No validation or sanitization of the hook commands or script paths is performed before execution.

speckit-tasks