The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a hooks mechanism that reads .specify/extensions.yml from the project root and automatically executes commands specified under hooks.before_implement and hooks.after_implement. If a hook is marked as mandatory (optional: false), the agent is instructed to use EXECUTE_COMMAND to run the arbitrary command provided in the file, allowing a local configuration to trigger arbitrary shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and follows instructions from untrusted repository files, creating an attack surface where project files can influence agent behavior.
Ingestion points: tasks.md, plan.md, .specify/extensions.yml, and files in checklists/.
Boundary markers: No explicit delimiters or instructions are used to prevent the agent from obeying malicious instructions embedded within these files.
Capability inventory: The skill has capabilities to execute shell commands (EXECUTE_COMMAND), run repository scripts ({SCRIPT}), and modify local files (creating/updating ignore files and marking tasks in tasks.md).
Sanitization: No sanitization or validation is performed on the commands or tasks read from the repository files before execution or processing.
[DYNAMIC_EXECUTION]: The skill's workflow depends on running dynamically identified scripts ({SCRIPT}) and configuration-driven hooks, leading to the execution of logic not contained within the static skill definition.

speckit-implement