The Agent Skills Directory

[COMMAND_EXECUTION] (MEDIUM): The script scripts/check-prerequisites.sh executes eval $(get_feature_paths). The get_feature_paths function in scripts/common.sh populates its output using the current Git branch name or the SPECIFY_FEATURE environment variable. If an attacker can control the branch name (e.g., through a malicious repository or PR), they can inject arbitrary shell commands (e.g., branch-name';id;') that will be executed with the user's privileges when the skill is run.
[PROMPT_INJECTION] (LOW): The skill is vulnerable to Indirect Prompt Injection because it reads the contents of tasks.md and passes them to a GitHub MCP server to create issues. Malicious instructions inside tasks.md could manipulate the agent into creating unauthorized or harmful repository content. Ingestion points: tasks.md via scripts/check-prerequisites.sh. Boundary markers: None. Capability inventory: GitHub MCP server issue creation, local shell execution. Sanitization: None detected.

speckit-taskstoissues