The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to run a local shell script located at .specify/scripts/bash/setup-tasks.sh during the outline phase. Executing scripts provided by the project repository assumes the repository content is trusted and can lead to arbitrary code execution.
[REMOTE_CODE_EXECUTION]: The skill implements an 'Extension Hooks' mechanism that reads commands from a project-controlled file (.specify/extensions.yml). It instructs the agent to automatically execute these commands using the EXECUTE_COMMAND directive for mandatory hooks. This creates a high-risk vector where a project can trigger arbitrary command execution on the user's system.
[PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources, including user-supplied $ARGUMENTS and various project files (plan.md, spec.md, etc.).
Ingestion points: .specify/extensions.yml, plan.md, spec.md, data-model.md, contracts/, research.md, quickstart.md, and $ARGUMENTS.
Boundary markers: The skill lacks explicit delimiters or instructions to the agent to ignore potentially malicious embedded instructions within these data sources.
Capability inventory: The skill possesses powerful capabilities including command execution (EXECUTE_COMMAND) and shell script invocation.
Sanitization: There is no evidence of sanitization or validation of the content retrieved from the project files before it is used to influence the agent's workflow.

speckit-tasks