The Agent Skills Directory

[PROMPT_INJECTION]: No malicious injection patterns detected. The skill uses strict phase-based logic and mandatory user approval gates which act as a defense against instruction overriding.
[DATA_EXFILTRATION]: No exfiltration patterns found. The skill's operations are confined to the local project's specs/ directory and codebase. It does not perform unauthorized network requests.
[REMOTE_CODE_EXECUTION]: The skill uses the Bash tool to execute standard development commands (e.g., npm test, git status) as part of the validation and implementation phases. No patterns involving downloading and piping remote scripts to a shell were found.
[EXTERNAL_DOWNLOADS]: The documentation references cloning from the official Snowflake-Labs GitHub repository for installation. These are trusted vendor resources and do not represent a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local codebase and specification files. While this is an inherent attack surface for development tools, the risk is mitigated by the structured workflow and the requirement for human review at every phase.
Ingestion points: Reads source code and existing specs/ markdown files (e.g., requirements.md, design.md).
Boundary markers: Uses structured Markdown headers and YAML frontmatter to delimit data sections.
Capability inventory: Includes file system access (Read, Write, Edit), shell execution (Bash), and project search (Grep, Glob).
Sanitization: Not explicitly implemented in the instructions; the skill relies on the phased approval gates for safety.

spec-driven