The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local shell script located at .specify/scripts/bash/check-prerequisites.sh during its initialization phase. Executing scripts from the local environment without integrity checks can lead to code execution if the environment is compromised.
[REMOTE_CODE_EXECUTION]: The skill features an extension hook system that reads commands from .specify/extensions.yml and instructs the agent to run them using the EXECUTE_COMMAND directive. This dynamic execution of commands defined in a configuration file allows for arbitrary code execution if an attacker can modify the YAML file.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes untrusted data from various project files (spec.md, plan.md, tasks.md) and the codebase itself to generate its findings. Maliciously crafted content in these files could subvert the agent's logic.
Ingestion points: Reads project artifacts (spec.md, plan.md, tasks.md), configuration (.specify/extensions.yml), and source code files.
Boundary markers: No specific delimiters or markers are used to encapsulate and isolate the content of the analyzed files from the agent's instructions.
Capability inventory: The skill has the ability to execute shell scripts and dynamically invoked agent commands.
Sanitization: There is no evidence of sanitization or validation performed on the data retrieved from the codebase or the configuration files before they are used in the assessment or command execution flow.

speckit-converge