The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local script at .specify/scripts/bash/check-prerequisites.sh to retrieve project paths. While this is a standard project-relative path, the execution relies on the integrity of the local environment.
[COMMAND_EXECUTION]: The skill implements an extension hook system that can trigger commands defined in .specify/extensions.yml. It uses the EXECUTE_COMMAND directive for mandatory hooks, which allows the execution of defined slash commands based on local configuration.
[PROMPT_INJECTION]: The skill ingests untrusted data from $ARGUMENTS and user responses during the clarification loop, which are then persisted into the feature specification file.
Ingestion points: User input via $ARGUMENTS and interactive questioning loop in SKILL.md.
Boundary markers: The instructions do not specify explicit delimiters or 'ignore' instructions for the interpolated user content.
Capability inventory: The agent has the capability to execute a local bash script and perform atomic overwrites of the file path specified in FEATURE_SPEC.
Sanitization: The skill includes instructions to escape single quotes when passing arguments to the prerequisite script, providing basic protection against shell-level injection.

speckit-clarify