The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill ingests untrusted user input (principles/amendments) and propagates them into multiple critical files including prompt templates, agent definitions, and other skills.
Ingestion points: User-provided principles or amendments in conversation.
Capability inventory: The workflow allows overwriting .specify/memory/constitution.md and modifying files in .claude/commands/, .github/prompts/, .github/agents/, and skills/speckit-*/SKILL.md.
Boundary markers: None. The instructions tell the agent to 'Replace every placeholder with concrete text' from user input.
Sanitization: None. There are no checks to prevent a user from providing a principle that contains malicious instructions meant to hijack other agents or tools.
Command Execution Risk (MEDIUM): While the skill doesn't execute shell commands directly, by modifying SKILL.md files and prompt/command definitions in the repository, it can alter the behavior of other tools that do execute code, effectively leading to persistent command injection.

speckit-constitution