The Agent Skills Directory

[COMMAND_EXECUTION]: Executes a local bash script .specify/scripts/bash/check-prerequisites.sh from the project repository. If the repository being processed is untrusted or contains malicious content, this leads to arbitrary code execution.
[COMMAND_EXECUTION]: Implements an extension hook system that parses .specify/extensions.yml and instructs the agent to execute commands found there using the EXECUTE_COMMAND directive. This allows repository-controlled configuration to trigger arbitrary agent actions.
[PROMPT_INJECTION]: Directly interpolates user-provided $ARGUMENTS into the prompt with an instruction that the agent "MUST consider" them, which facilitates prompt injection to override the skill's logic.
[PROMPT_INJECTION]: Vulnerable to indirect prompt injection through data processed from the repository.
Ingestion points: Reads hook definitions from .specify/extensions.yml and task descriptions from tasks.md.
Boundary markers: Absent. The skill does not use delimiters or instructions to prevent the agent from obeying instructions embedded in the project files.
Capability inventory: The skill can execute bash scripts, invoke agent commands, read/write local files, and create issues via the GitHub MCP.
Sanitization: None detected. Data from the repository is used directly to construct commands and issue titles.

speckit-taskstoissues