The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Node.js scripts located in the .specforge/core/scripts/ directory, such as instructions.mjs, sync-wiki.mjs, and gate.mjs. These commands are used for internal project management and do not involve remote or unverified sources.
[PROMPT_INJECTION]: The skill processes project artifacts (e.g., PRDs, requirements, technical designs) as input for wiki updates, which constitutes an indirect prompt injection surface. However, the risk is addressed by the structured workflow rules and the mandatory manual gate approval process (gate.mjs APPROVED) required to finalize changes.
[DATA_EXFILTRATION]: No network operations or unauthorized file access patterns were detected. The skill instructions explicitly mandate that real secret values must not be written to the wiki files.

sf-wiki