The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and acting upon various external files that could contain malicious instructions.
Ingestion points: The skill reads TASK-XXX.md, functional specifications, decision-log.md, ontology.md, data-model.md, and architecture.md across Phases 1 through 5.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when interpolating the content of these external files into the agent's context.
Capability inventory: The skill has the capability to execute shell commands (grep in Phase 2), write to the local filesystem (updating traceability-matrix.md in Phase 3 and generating review reports in Phase 7), and invoke other tools (specs-kit-sync in Phase 7).
Sanitization: There is no mention of sanitizing or validating the input data from the documentation files before it influences the agent's decision-making process or file-writing operations.
[COMMAND_EXECUTION]: The skill utilizes local shell commands to perform its verification tasks. Specifically, in Phase 2, it executes a grep pipeline (grep -r "@Test" src/test/ --include="*.java" | wc -l) to count test annotations. While the command is targeted at local source files, it represents a capability that could be targeted by indirect injection via manipulated file content or structures.

specs-kit-task-review