The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is centered around executing shell commands via the specify CLI to manage extensions, catalogs, and project configuration.
[REMOTE_CODE_EXECUTION]: The command specify extension add <name> --from <url> enables the agent to fetch and install extensions from arbitrary external URLs. Since extensions add reusable commands and hooks to a project, this represents a direct vector for downloading and executing untrusted code.
[INDIRECT_PROMPT_INJECTION]: The skill manages the ingestion of external code that is subsequently integrated into the agent's context as new skills.
Ingestion points: Extensions are fetched from external URLs, local directories via the --dev flag, or third-party catalogs added via specify extension catalog add.
Boundary markers: The skill does not provide instructions or markers to ensure the agent ignores instructions potentially embedded within the downloaded extension files.
Capability inventory: The skill facilitates writing executable content into the .github/skills/ directory and executing it via the CLI.
Sanitization: There is no evidence of validation or sanitization for the content of the extensions being installed.
[DYNAMIC_EXECUTION]: The skill supports dynamic loading of logic by placing installed extension commands into the .github/skills/ directory and instructing the user/agent to use /skills reload to activate them in the current session.

speckit-extension