The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a hook system that automatically executes shell commands specified in the project-controlled file .specify/extensions.yml using the EXECUTE_COMMAND directive. This pattern allows a malicious repository to run arbitrary code on the user's machine.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by processing untrusted data from multiple project files without proper isolation or sanitization.
Ingestion points: .specify/extensions.yml, .specify/memory/constitution.md, and .specify/init-options.json (File: SKILL.md)
Boundary markers: Absent. The skill instructions do not include delimiters or warnings to ignore embedded instructions in these files.
Capability inventory: EXECUTE_COMMAND (command execution), mkdir (directory creation), cp (file copying), and multiple file-write operations across the project structure.
Sanitization: None. The skill directly parses and acts upon the content of these files, including using them to construct and run executable commands.
[DATA_EXFILTRATION]: The combined capability of reading local project configuration and executing arbitrary commands provides a mechanism for an attacker to access and exfiltrate sensitive local data or credentials if the project context is malicious.

speckit-specify