The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automatically executes shell commands defined within the project's .specify/extensions.yml file. These commands are triggered during the 'Pre-Execution Checks' and 'Mandatory Post-Execution Hooks' phases using the EXECUTE_COMMAND: directive.
[COMMAND_EXECUTION]: The skill runs a local bash script located at .specify/scripts/bash/setup-plan.sh during the initialization of the planning outline.
[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface by processing untrusted data from the project directory to influence agent behavior and command execution.
Ingestion points: Reads .specify/extensions.yml, FEATURE_SPEC, and constitution.md from the project root.
Boundary markers: Absent. The skill does not provide instructions to the agent to treat the contents of these files as data rather than instructions.
Capability inventory: High-privilege actions including shell command execution (EXECUTE_COMMAND), file system writes (generating .md files), and modification of configuration files (CLAUDE.md).
Sanitization: None. The skill does not validate or sanitize the commands retrieved from the extension configuration before execution.

speckit-plan