The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a hook system that reads command strings from a .specify/extensions.yml file in the project root and explicitly instructs the agent to execute them. This applies to both pre-execution and post-execution phases.
[REMOTE_CODE_EXECUTION]: The instructions require the agent to run a script (referred to as {SCRIPT}) from the repository root as part of the setup process. Executing scripts from untrusted repositories is a significant security risk as the content of the script is controlled by the repository author.
[INDIRECT_PROMPT_INJECTION]: The skill processes various design artifacts and configuration files from the local environment to generate tasks, creating a surface for indirect instructions.
Ingestion points: Files including plan.md, spec.md, data-model.md, and .specify/extensions.yml.
Boundary markers: No delimiters or safety instructions are used to prevent embedded commands or instructions in these files from influencing the agent's behavior.
Capability inventory: The skill is capable of executing shell commands and writing files to the local file system.
Sanitization: Content from the ingested files is used directly without validation or escaping during the task generation process.
[DYNAMIC_EXECUTION]: The extension hook mechanism allows for the dynamic assembly and execution of shell commands based on configuration data read from an external file at runtime.

speckit-tasks