The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted feature descriptions via $ARGUMENTS which are used to generate file content and determine directory structures.
Ingestion points: $ARGUMENTS (User-provided feature description).
Boundary markers: None identified in the prompt templates.
Capability inventory: Directory creation (mkdir), file writing (spec.md, requirements.md, feature.json), and command execution via extension hooks.
Sanitization: No explicit sanitization or escaping of the user-provided description is mentioned before interpolation.
[COMMAND_EXECUTION]: The skill implements an extension system that reads .specify/extensions.yml from the project root and automatically executes shell commands identified as mandatory hooks using the EXECUTE_COMMAND directive. This behavior relies on the integrity of local project files; a malicious repository could contain a configuration file that triggers unauthorized commands when this skill is run.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads several project-internal configuration and memory files, including .specify/extensions.yml, .specify/init-options.json, and .specify/memory/constitution.md, and persists data to .specify/feature.json.

speckit-specify