The Agent Skills Directory

[COMMAND_EXECUTION]: Potential command injection risk. In Phase 4, the skill executes shell commands (mkdir, mv) using directory names derived from user-provided $ARGUMENTS. If these arguments contain shell metacharacters or are not strictly validated against an allowlist of legitimate specification names, it could lead to arbitrary command execution or unauthorized file system operations. While the skill mentions escaping single quotes, this is insufficient to prevent all forms of shell injection.
[PROMPT_INJECTION]: Indirect prompt injection vulnerability surface. The skill ingests and processes data from external files such as research.md and spec.md, which are treated as source material for generating documentation. Malicious instructions embedded in these files could influence the agent's behavior during the extraction or review phases.
Ingestion points: Reads content from spec.md, research.md, data-model.md, plan.md, and files in contracts/.
Boundary markers: No explicit delimiters or instructions are used to prevent the agent from obeying commands embedded within the extracted text.
Capability inventory: The skill possesses the ability to write files to various documentation directories, create new directories, and move existing spec directories to an archive location.
Sanitization: There is no evidence of sanitization or structural validation for the content extracted from the specification files before it is processed or written.

speckit-opsmill-extract