The Agent Skills Directory

[COMMAND_EXECUTION]: The skill identifies and invokes commands based on entries in the project-local .specify/extensions.yml file using the EXECUTE_COMMAND directive. This allows for automated execution of tasks (hooks) defined within the repository's configuration.\n- [DYNAMIC_EXECUTION]: Command names are dynamically generated at runtime by transforming strings from the extensions configuration file (e.g., replacing dots with hyphens). This dynamic assembly of command identifiers depends on the integrity of the local configuration files.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied feature descriptions to generate technical requirements and success criteria, potentially allowing malicious instructions in the input to influence the generated output or system operations.\n
Ingestion points: Raw user input is ingested via the $ARGUMENTS parameter in SKILL.md.\n
Boundary markers: No specific boundary markers or instructions to ignore embedded commands are used for user input.\n
Capability inventory: The skill can create directories (mkdir), copy files (cp), write new specification files, and execute other commands (EXECUTE_COMMAND).\n
Sanitization: There is no evidence of input validation, sanitization, or filtering of the user-provided arguments before they are used in prompt interpolation or file system operations.

speckit-specify