The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install additional 'specialist' skills from the vendor's GitHub repository (github.com/promovaweb/specsfy) using the npx skills add command.
[COMMAND_EXECUTION]: Several local Node.js scripts are executed to perform project monitoring, database safety checks, and task validation (e.g., check_database_safety.mjs, monitor_context.mjs, and validate_tasks.mjs). These are core to the skill's workflow and operate on the project's files.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from specification files (spec.md) which may contain untrusted content. While the skill uses validation scripts to enforce structural requirements (Gherkin format, task IDs, checklists), there is a potential surface for indirect instructions to influence agent behavior during the task generation phase.
Ingestion points: Reads specification data from specs/<estado>/<NNNN>-<slug>/spec.md and .specsfy/Spec.md.
Boundary markers: None explicitly used during prompt interpolation, though scripts perform structural parsing.
Capability inventory: Executes shell commands for validation and installation; writes updates back to the specification files.
Sanitization: Employs regex-based validation in validate_tasks.mjs to ensure tasks follow a canonical format.
[DYNAMIC_EXECUTION]: The script validate_tasks.mjs uses spawnSync to dynamically execute another script (verify_evidence.mjs) if the specification declares a specific evidence contract. This allows for runtime extension of the validation process based on project configuration.

specsfy-05-tasks