The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from local project files (requirements.md, solution.md, CLAUDE.md) to generate unit specifications and test stubs, which represents a potential injection surface.
Ingestion points: Files named requirements.md, solution.md, CLAUDE.md, and AGENTS.md are read during the initialization and decomposition phases as defined in SKILL.md.
Boundary markers: The instructions do not specify explicit delimiters or "ignore embedded instructions" headers when interpolating these files into the generation process.
Capability inventory: The skill has the capability to write multiple markdown and test stub files to the specDirectory specified in the constraints.
Sanitization: There is no mention of sanitization or escaping logic for external content processed by the skill.
Assessment: This finding is considered safe as the data processing is fundamental to the skill's purpose and the workflow enforces manual user review and approval at every major checkpoint (Units, Scenarios, and Manifest) before finalization.
[SAFE]: The skill restricts file writing to a specific specDirectory and uses templates for all generated artifacts. It does not perform network operations, use privilege escalation commands, or exhibit persistence mechanisms. Metadata and persona instructions align with the stated purpose of technical decomposition.

specify-factory