The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes PreToolUse hooks for the Write and Edit tools to execute a local script, ds-reviewer-readonly-guard.py, via the uv Python package manager. This implementation serves as a policy enforcement mechanism to prevent modifications to the project state while a specification is under review.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) due to the way the reviewer subagent processes project data.
Ingestion points: The reviewer subagent is instructed to read and evaluate .planning/SPEC.md. This file is generated in a prior phase based on user inputs and requirements.
Boundary markers: The instructions for the subagent do not define clear delimiters or include warnings to ignore embedded natural language instructions within the specification file content.
Capability inventory: The subagent is granted several capabilities including Read, Glob, Grep, and Bash(read-only). While restricted from writing, these tools could be manipulated to leak context or perform unauthorized reconnaissance if an injection is successful.
Sanitization: There is no evidence of sanitization, filtering, or validation performed on the specification content before it is processed by the subagent's logic.

ds-spec-reviewer