The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a project-local PowerShell script located at repo root: .specify/scripts/powershell/setup-tasks.ps1 -Json. This script is used to initialize the task generation environment and parse project paths.
[DYNAMIC_EXECUTION]: The skill implements a hook system that reads .specify/extensions.yml from the project root and executes commands defined under hooks.before_tasks and hooks.after_tasks. It specifically triggers mandatory hooks using the EXECUTE_COMMAND: {command} pattern, which instructs the agent to invoke arbitrary commands. This allows a potentially malicious repository to execute unauthorized actions on the user's system by providing a crafted configuration file.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources to influence its logic and output.
Ingestion points: Reads content from plan.md, spec.md, data-model.md, contracts/, research.md, quickstart.md, and .specify/memory/constitution.md as specified in the 'Outline' section of SKILL.md.
Boundary markers: The skill does not define specific delimiters or instructions for the agent to ignore potentially malicious embedded commands within these files.
Capability inventory: The skill has the capability to execute local scripts (setup-tasks.ps1), trigger agent commands via EXECUTE_COMMAND, and write to the local file system (tasks.md).
Sanitization: There is no evidence of sanitization, validation, or filtering of the content read from these external files before it is processed by the agent to generate tasks.

speckit-tasks