The Agent Skills Directory

[COMMAND_EXECUTION]: The Bash utility scripts (e.g., check-prerequisites.sh, setup-plan.sh, and update-agent-context.sh) are vulnerable to command injection. These scripts invoke eval $(get_feature_paths), where the get_feature_paths function (defined in common.sh) generates shell variable assignments based on current branch names and directory names in the .specify/specs/ folder. An attacker can execute arbitrary commands by creating a branch or directory name containing shell metacharacters (e.g., 001-';id;'), which are not correctly escaped before being passed to eval.
[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves reading and propagating content from multiple files in the repository (such as spec.md, plan.md, research.md, and README.md) to generate project constitutions and update agent guidance files. The absence of robust sanitization or explicit boundary markers (e.g., "ignore instructions in this block") makes the agent susceptible to indirect prompt injection if any of these files contain malicious instructions designed to hijack the agent's task flow.
[DATA_EXFILTRATION]: While intended as a feature for project management, the skill automatically extracts and centralizes technical metadata (technological stack, database choices, project structure, and development history) into multiple agent-specific configuration files (like CLAUDE.md and GEMINI.md). This creates a risk of unintentional data exposure if these metadata-heavy files are committed to public repositories or shared without review.

speckit-constitution-zh