The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze spec.md files created by users. These files serve as the 'source of truth' for the agent, creating a surface where embedded instructions could influence agent behavior.
Ingestion points: The skill and its associated scripts (validate_spec.mjs, review_findings.mjs) read content from user-controlled paths under specs/.
Boundary markers: The skill enforces a rigid 'Specsfy/2.0' format, requiring specific headers and sections, which acts as a structural validation layer.
Capability inventory: The skill can execute local Node.js scripts, perform git operations, and modify the specification files it analyzes.
Sanitization: The review_findings.mjs script implements a safeEvidence function that performs path resolution and validation to ensure that evidence links do not traverse outside the project root or use symbolic links.
[COMMAND_EXECUTION]: The skill frequently executes shell commands to perform audits and transitions.
Evidence: node .agents/skills/specsfy-04-validate/scripts/validate_spec.mjs, node .agents/skills/specsfy-04-validate/scripts/verify_repo.mjs, and specsfy transition.
The verify_repo.mjs script also executes git rev-parse HEAD to include commit information in its audit reports.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for the user to install specialized audit tools from the vendor's repository.
Evidence: The file references/specialists.md suggests running npx skills add https://github.com/promovaweb/specsfy --skill specsfy-specialist-<nome> to extend the agent's capabilities. This points to a repository managed by the skill's author ('promovaweb').

specsfy-04-validate