The Agent Skills Directory

[COMMAND_EXECUTION]: The skill generates and instructs the execution of shell commands using unsanitized user input in the final artifact organization phase.
Evidence: In the "Completion" section, the skill executes a bash script: mkdir -p .specs/features/$DATE-$FEATURE_SLUG/artifacts/nextjs and mv .nextjs-dev/... .specs/features/$DATE-$FEATURE_SLUG/.... The variable $FEATURE_SLUG is derived from the user-controlled $FEATURE ($ARGUMENTS). The shell script uses these variables without double-quoting. If the agent fails to strictly remove all shell metacharacters as instructed, or if an attacker provides a carefully crafted string (e.g., my-feature; rm -rf /), it could lead to arbitrary command execution during the cleanup process.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted requirements and codebase data, passing them through a chain of subagents without sufficient boundary protection.
Ingestion points: User requirements collected via AskUserQuestion and the project's own source code files analyzed by the code-explorer agent.
Boundary markers: Absent. The instructions for subagents (e.g., Next.js Developer, Test Automator) use raw interpolation: [Insert full contents of .nextjs-dev/01-requirements.md]. There are no delimiters or instructions to ignore embedded commands within these files.
Capability inventory: The subagents have extensive capabilities, including writing arbitrary code to the project directory, creating test suites, and performing code reviews, which could be subverted if the requirements or explored code contain malicious instructions.
Sanitization: While the skill instructs the agent to remove special characters for the directory slug, it does not specify sanitization for the actual content processed by the subagent team.

nextjs-feature-development