The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes project-level configuration files and specifications to drive its workflow without sufficient sanitization or boundary markers.
Ingestion points: Reads .specify/extensions.yml for hook definitions, FEATURE_SPEC for technical requirements, and .specify/memory/constitution.md for project rules.
Boundary markers: Absent. The skill directly interpolates content from these files into its execution logic and prompt context.
Capability inventory: Execution of slash commands via EXECUTE_COMMAND, execution of PowerShell scripts (setup-plan.ps1), and arbitrary file system read/write operations.
Sanitization: No validation or sanitization is performed on the command strings or data extracted from these files before they are used to trigger agent actions.
[DYNAMIC_EXECUTION]: The skill implements a hook system that automatically triggers the execution of slash commands based on entries found in a local configuration file.
Evidence: The instructions state: "Mandatory hook (optional: false) — You MUST emit EXECUTE_COMMAND: for each mandatory hook".
Risk: This allows the project configuration (.specify/extensions.yml) to control which commands the agent executes, potentially leading to the execution of malicious slash commands if the file is compromised.
[COMMAND_EXECUTION]: The skill executes a local PowerShell script as part of its initialization phase.
Evidence: Step 1 of the Outline instructs to "Run .specify/scripts/powershell/setup-plan.ps1 -Json from repo root".
Risk: Execution of scripts residing within the workspace assumes the repository content is inherently safe, which may not be the case in multi-user or untrusted environments.

speckit-plan