The Agent Skills Directory

REMOTE_CODE_EXECUTION (HIGH): The skill directs users to install and initialize the 'speckit' tool from an untrusted repository. \n
Evidence: tools/speckit/SKILL.md contains instructions for npx speckit init and pip install speckit. \n
Risk: The source github/spec-kit is not on the trusted external source list, leading to potential execution of malicious remote code during installation. \n- PROMPT_INJECTION (HIGH): The 'speckit' sub-skill defines an end-to-end automated workflow that lacks security boundaries for external data. \n
Ingestion points: Untrusted natural-language prompts enter the system via the /speckit.specify command. \n
Boundary markers: Absent; there are no instructions to delimit or ignore instructions within the generated specifications. \n
Capability inventory: The /speckit.implement command has the capability to write and execute code across the entire project based on the (potentially poisoned) specification. \n
Sanitization: Absent; no validation or filtering is mentioned for the transition from user prompt to implementation. \n- COMMAND_EXECUTION (MEDIUM): Initialization of the recommended tooling involves modifying the agent's core configuration files. \n
Evidence: tools/speckit/SKILL.md explicitly states that it 'installs its slash commands into your project's agent configuration folder (.claude/, .github/prompts/, .cursor/, etc.)'. \n
Risk: This allows an external tool to persist and modify the agent's behavior across sessions without manual verification of the injected prompts.

specs