The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Node.js scripts distributed within its package, including iniciar_spec.mjs and load_research.mjs. These scripts automate the initialization of specification folders and validate research artifacts locally.
[EXTERNAL_DOWNLOADS]: The skill's documentation recommends expanding its capabilities by installing additional specialist skills from the vendor's official GitHub repository (github.com/promovaweb/specsfy) via the npx skills add command.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, such as user stories, interview transcripts, and third-party documentation, to produce technical requirements.
Ingestion points: It reads user-provided files from the specs/inbox/ directory and external research artifacts stored in the research/ subfolder.
Boundary markers: The MCR-10 protocol implemented by the skill explicitly requires the agent to categorize data as 'Declared' (user input) versus 'Infered' (agent deduction), which acts as a logical boundary to prevent command override.
Capability inventory: The skill possesses file-writing capabilities and the ability to execute its own helper scripts.
Sanitization: The load_research.mjs script performs path validation to ensure file access is restricted to the designated research directory and explicitly blocks symbolic links to prevent directory traversal attacks.

specsfy-03-specify