The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and processes multiple local files including configuration (.spec-superflow.yaml), templates (templates/spec.md), and existing planning artifacts (proposal.md, specs/, design.md, tasks.md). These files represent an attack surface where malicious instructions could be embedded by external actors or compromised dependencies.
Ingestion points: .spec-superflow.yaml, proposal.md, specs/, design.md, tasks.md, templates/spec.md (as specified in SKILL.md).
Boundary markers: Absent; the skill does not instruct the agent to use delimiters or ignore embedded instructions within these files.
Capability inventory: The skill executes shell commands via the ssf (Spec Superflow) CLI tool (ssf runtime config, ssf state set, ssf state transition).
Sanitization: No sanitization logic is defined for the content extracted from artifacts before it is used in CLI command arguments.
[COMMAND_EXECUTION]: The skill uses the ssf command-line utility for project state management and configuration. It specifically instructs the agent to construct commands like ssf state set <change-dir> dp_2_result "approved: <summary>". If the generated <summary> contains shell metacharacters (e.g., backticks, semicolons) derived from malicious project files, it could lead to command injection within the local environment.

spec-writer