The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute specific local Node.js scripts located within the .specforge/core/scripts/ directory. These commands (e.g., artifact-graph-status.mjs, create-artifact.mjs) are used to manage project state and generate task artifacts. The paths are restricted to the local project structure and do not involve dynamic command construction from untrusted input.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes project-level documentation like requirements.md and technical-design.md. Malicious instructions embedded in these specification files could theoretically influence the agent's task generation logic.
Ingestion points: Reads project-specific markdown files including brief.md, requirements.md, ui-design.md, technical-design.md, gap-report.md, and research.md (specified in SKILL.md and stages/task-planning/SKILL.md).
Boundary markers: The instructions mandate a highly structured output format using specific field headers (e.g., _Trace:_, _Files:_, _Verification:_), which serves as a functional boundary for the generated content.
Capability inventory: The skill possesses the capability to execute local shell commands via node and perform file write operations to create the tasks.md artifact.
Sanitization: No explicit sanitization or escaping protocols are defined for handling content extracted from the input documentation files.

sf-tasking