The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes multiple untrusted project files to determine its execution flow, creating a potential attack surface for indirect prompt injection.
Ingestion points: Reads content from tasks.md, plan.md, .specify/extensions.yml, and various other documentation files (data-model.md, contracts/, etc.).
Boundary markers: The instructions do not define clear delimiters or warnings to ignore instructions that might be embedded within these data files.
Capability inventory: The skill has the ability to execute local PowerShell scripts, modify project files (marking tasks as complete), and trigger other agent slash commands via EXECUTE_COMMAND hooks.
Sanitization: There is no explicit sanitization or validation logic for the content read from these external files before it is used to drive agent actions.
[COMMAND_EXECUTION]: The skill instructs the agent to run a local PowerShell script: .specify/scripts/powershell/check-prerequisites.ps1. This represents the execution of code residing within the user's project directory.
[DYNAMIC_EXECUTION]: The skill implements a hook system that reads command names from .specify/extensions.yml and triggers them using EXECUTE_COMMAND. This allows project configuration to dynamically dictate which subsequent agent commands are executed.

speckit-implement