The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources including user-provided arguments and local project configuration files without sufficient boundary markers or sanitization instructions.
Ingestion points: Reads from $ARGUMENTS, .specify/extensions.yml, .specify/init-options.json, and .specify/memory/constitution.md.
Boundary markers: Absent. The skill interpolates user input and project data directly into its processing flow without delimiters or instructions to ignore embedded commands.
Capability inventory: Includes directory creation (mkdir), file writing (spec.md, feature.json, requirements.md), and triggering other agent commands via EXECUTE_COMMAND.
Sanitization: Absent. There is no evidence of escaping or filtering logic for the ingested external content.
[COMMAND_EXECUTION]: The skill uses the EXECUTE_COMMAND: trigger to invoke other slash commands (e.g., /speckit-git-commit) defined within the .specify/extensions.yml file. This allows project-level configuration to orchestrate agent behavior and trigger external tooling actions.
[DYNAMIC_EXECUTION]: The extension hook mechanism dynamically constructs slash commands at runtime by transforming hook names from a YAML configuration (e.g., converting dots to hyphens). This dynamic assembly and subsequent execution of commands creates a flexible but less predictable execution environment.

speckit-specify