The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements an extension hook system that reads from .specify/extensions.yml. For hooks configured with optional: false, the skill instructs the agent to automatically perform execution using the EXECUTE_COMMAND: {command} pattern. This behavior allows for arbitrary command execution when the skill is used in a project where the configuration file has been tampered with or intentionally contains malicious commands.
[PROMPT_INJECTION]: The skill directly incorporates external data from user input ($ARGUMENTS), project templates, and configuration files into the agent's operational context. The instructions lack boundary markers or sanitization logic to prevent the agent from interpreting instructions that may be embedded within these files, leading to potential indirect prompt injection.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Reads project configuration from .specify/extensions.yml, templates from .specify/templates/*.md, and the existing constitution from .specify/memory/constitution.md.
Boundary markers: None. The skill does not use specific delimiters or instructions to ignore embedded commands within the processed file content.
Capability inventory: The skill has the capability to write to the file system (.specify/memory/constitution.md) and execute shell commands via the EXECUTE_COMMAND directive.
Sanitization: None. Data from external files is used to populate templates and define executed commands without validation or filtering.

speckit-constitution