speckit-taskstoissues

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow uses the GitHub MCP server to read outsider-authored free text from GitHub issue titles during the required runtime step “Fetch existing issues for deduplication” (list_issues → match issue titles against task IDs) before creating new issues.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill mandates executing repository hooks and scripts (e.g. "MUST actually invoke the hook" and running .specify/scripts/bash/check-prerequisites.sh), which forces the agent to run arbitrary commands on the host and could modify system state or perform privileged actions even though it doesn't explicitly request sudo or user creation.