The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documents a process for installing additional 'specialist' skills from the vendor's official GitHub repository (github.com/promovaweb/specsfy) using the npx skills add command. This is a standard extension mechanism for the Specsfy ecosystem and refers to resources owned by the skill's author.
[COMMAND_EXECUTION]: The skill executes several local maintenance and utility scripts (e.g., next_task.mjs, verify_evidence.mjs, render_delivery.mjs) to manage the task lifecycle. It also orchestrates project-level commands such as database migrations and tests. Security is managed by an integrated safety script (check_database_safety.mjs) that explicitly blocks destructive operations like DROP DATABASE or migrate:fresh.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external task specifications from spec.md files which act as untrusted data that guides agent behavior. This risk is mitigated through several layers:
Ingestion points: Specification files at specs/planned/, project research files, and package documentation.
Boundary markers: The skill enforces a strict format (Specsfy/2.0) and requires specific 'Definition' and 'Plan' gates to be passed before execution.
Capability inventory: The agent can perform file writes (code, tests) and shell executions (migrations, tests, documentation builds).
Sanitization: All potentially dangerous commands are passed through a database safety validator that prevents high-risk SQL and framework-specific destructive commands.

specsfy-07-implement