The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions include a 'Pre-Execution Checks' and 'Post-Execution Checks' phase that reads from a .specify/extensions.yml file in the project root. It instructs the agent to execute commands defined in this file (e.g., EXECUTE_COMMAND: {command}). If an attacker provides a project with a malicious extensions file, it could lead to the execution of arbitrary commands or scripts in the agent's environment.
[DYNAMIC_CONTEXT_INJECTION]: The 'Execution Steps' section describes running a {SCRIPT} from the repository root to parse environment data such as FEATURE_DIR. This pattern involves executing shell commands at runtime to populate the agent's context, which carries risks if the script or the environment variables are manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from the repository, including spec.md, plan.md, tasks.md, and .specify/extensions.yml. While it includes instructions for 'Context Loading Strategy' to minimize exposure, the ingestion of these files combined with the capability to execute commands via the extensions hook creates a surface for indirect prompt injection attacks.

speckit-checklist