The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is instructed to run a local PowerShell script located at .specify/scripts/powershell/check-prerequisites.ps1 with various arguments.
[DYNAMIC_EXECUTION]: The skill implements a plugin/extension system by reading .specify/extensions.yml and automatically triggering commands based on its content. Using the EXECUTE_COMMAND: {command} pattern for mandatory hooks allows configuration files within the repository to dictate which commands the agent executes.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect injection as it ingests data from several untrusted workspace files including .specify/extensions.yml, .specify/memory/constitution.md, and the output of the prerequisites script.
Ingestion points: .specify/extensions.yml (hooks), .specify/memory/constitution.md (principles), and script outputs.
Boundary markers: None identified. The instructions do not include delimiters or warnings to ignore embedded instructions in these files.
Capability inventory: Shell command execution, PowerShell script execution, and GitHub issue creation via the GitHub MCP server.
Sanitization: There is a brief mention of escaping single quotes for arguments, but no comprehensive sanitization for the dynamic hooks or file content.
[DYNAMIC_EXECUTION]: User-provided $ARGUMENTS are interpolated directly into the PowerShell command execution line, which can lead to argument injection if the escaping logic is bypassed.

speckit-taskstoissues