The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions mention using an external command-line tool suspec check <spec-path> for automated validation. This is a legitimate development workflow and does not involve elevated privileges.
[PROMPT_INJECTION]: The skill processes external, untrusted specification documents (<spec-path>), which creates a theoretical surface for indirect prompt injection. However, the instructions provide strong mitigating constraints, specifically directing the agent to only report findings and never modify the file or interpret the content as new instructions.
[DATA_EXPOSURE]: The skill is designed to read and analyze document content from a user-provided file path. This is the core intended functionality of the skill and no unauthorized or sensitive file access was observed.

spec-check