The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill is designed to update local "commands and scripts" by downloading content from a remote repository. This allows for the replacement of executable logic on the local system with remote code.
[COMMAND_EXECUTION]: The skill invokes PowerShell scripts (update-wrapper.ps1 and update-orchestrator.ps1) to perform updates, manage backups, and interact with the filesystem. These scripts have broad permissions to modify the project environment.
[EXTERNAL_DOWNLOADS]: The skill fetches templates and version metadata from GitHub's official repository and the GitHub Releases API. While these are well-known services, the practice of downloading and installing executable content for the agent's own toolset presents a significant attack surface.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by ingesting and processing data from external sources (GitHub) which is then presented to the agent. Ingestion points: Template files and manifest data fetched from the remote GitHub repository. Boundary markers: The instructions do not define delimiters or sanitization protocols for the remote content. Capability inventory: The skill can execute shell commands via PowerShell and has write access to the .specify/ and .claude/ directories. Sanitization: No validation or filtering of the remote data's content is described to prevent malicious instructions from being executed by the agent.

speckit-updater