The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to override the agent's core memory and safety logic by disregarding all prior conversational context.
Evidence: 'You MUST treat all prior conversational context as stale, unreliable, and non-authoritative' and 'If prior chat context differs from the files or repository state in any way, you MUST discard the prior chat context.'
[COMMAND_EXECUTION]: The skill executes local Node.js scripts and triggers the execution of arbitrary repository tests (lint and unit tests).
Evidence: Execution of node {{SKILL_DIR}}/scripts/spec-driven.js and instructions to 'actually run the tests (lint, unit tests) and confirm they pass.'
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from the local repository to drive its behavior without sanitization.
Ingestion points: Files within the .spec-driven/ directory, including proposal.md, tasks.md, and config.yaml (SKILL.md).
Boundary markers: Absent; the agent is instructed to adopt the content of these files as its primary 'source of truth' over its own instructions.
Capability inventory: Shell command execution via node and test runners, and file system write access for updating specs and task lists.
Sanitization: No validation or escaping of the ingested file content is mentioned.

spec-driven-apply