speckit-specify

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to read .specify/extensions.yml and emit hook command strings (including an explicit "EXECUTE_COMMAND: {command}") verbatim, which would cause any secrets embedded in those commands or the YAML to be output by the LLM.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). During /speckit-specify, the workflow explicitly ingests outsider-authored free text from the triggering message (“The text the user typed after /speckit-specify … is the feature description”) into the spec-generation steps.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill mandates creating and writing project files and — critically — requires actually invoking arbitrary "before_specify" and "after_specify" hook commands from .specify/extensions.yml (including emitting EXECUTE_COMMAND and waiting for them), which forces the agent to run external commands that could modify the host system or perform privileged actions.