The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes specific local Node.js scripts located within the project's .specforge/core/scripts/ directory, such as instructions.mjs, create-artifact.mjs, and artifact-quality.mjs. These commands are used for workflow orchestration and quality enforcement within the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from product requirement documents and user briefs. It effectively mitigates this surface through a mandatory evidence chain:
Ingestion points: Untrusted data enters the context via 00-intake/ files (original-request.md, brief.md, prd.md, brainstorm.md).
Boundary markers: Utilizes explicit markers like [NEEDS CLARIFICATION], [NEEDS DEPENDENCY DECISION], and [NEEDS TOOLING DECISION] to isolate pending items.
Capability inventory: Capabilities are limited to executing specific local scripts and writing to the 01-spec/ directory.
Sanitization: Implements strict translation logic that distinguishes between user-confirmed sources and agent-recommendation, ensuring that only verified inputs are converted into authoritative MUST/SHALL requirements.

sf-requirements