The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell or skill commands defined within the .specify/extensions.yml file under the hooks.before_constitution and hooks.after_constitution keys.
[COMMAND_EXECUTION]: The process requires the execution of a resolver script, referenced as {SCRIPT}, from the repository root to determine the active template content.
[DYNAMIC_EXECUTION]: The skill utilizes a hook-based architecture where execution logic is dynamically loaded from a YAML configuration file at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from various repository files, including READMEs and documentation, to populate placeholders in the constitution. It also reads the .specify/extensions.yml file, which serves as a control plane for command execution.
[INDIRECT_PROMPT_INJECTION]: Mandatory Evidence Chain: 1. Ingestion points: .specify/extensions.yml, README.md, project documentation, and .specify/memory/constitution.md. 2. Boundary markers: Absent; no explicit delimiters or warnings are used when interpolating file content into prompts or command contexts. 3. Capability inventory: The skill writes to .specify/memory/constitution.md and executes commands via the hook system in SKILL.md. 4. Sanitization: Absent; no sanitization or validation of the content retrieved from repository files is performed before execution.

speckit-constitution