The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local tools using Node.js (.specforge/tools/instructions.mjs and .specforge/tools/gate.mjs) to determine review types and update gate statuses. These are project-internal scripts.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted external data (requirements, designs, and code implementations) to perform its primary function.
Ingestion points: Files identified as spec_review or code_review artifacts are read into the agent's context for analysis.
Boundary markers: The skill references .specforge/rules/boundaries.md to define scope, but lacks explicit instructions to ignore natural language commands embedded within the reviewed data.
Capability inventory: The agent can execute shell commands (node) based on the results of its review, creating a path for an attacker to influence command parameters (e.g., the <gate> or <path> arguments) through malicious content in the review artifacts.
Sanitization: There is no evidence of sanitization or escaping of the reviewed content before it is processed by the agent's reasoning engine.

specforge-review