speckit-plan
Warn
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script at
.specify/scripts/bash/setup-plan.shfrom the repository root during initialization. - [COMMAND_EXECUTION]: The skill implements a dynamic hook system that reads command names from a configuration file (
.specify/extensions.yml) and instructs the agent to execute them using theEXECUTE_COMMANDdirective. This facilitates arbitrary command execution based on project-local content. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting data from configuration files and script outputs to drive agent behavior and command execution. Ingestion points: Reads from
.specify/extensions.ymland the JSON output of the setup script. Boundary markers: None. The instructions do not include delimiters or warnings to treat this external data as untrusted. Capability inventory: The skill can perform file system writes (e.g., toCLAUDE.md,research.md), execute shell scripts, and trigger arbitrary agent commands. Sanitization: The skill applies shell argument escaping for user arguments but lacks validation or sanitization for commands and descriptions loaded from the extension configuration.
Audit Metadata