[Bug] sdd-verify skill executes arbitrary command strings from repo-defined files

[imperius361]

📋 Pre-flight Checks

• I have searched existing issues and this is not a duplicate
• I understand this issue needs status:approved before a PR can be opened

📝 Bug Description

The sdd-verify skill reads test/build command strings directly from repository files (openspec/config.yaml, package.json scripts, Makefile targets) and executes them verbatim. A malicious or compromised repository can supply a crafted command string that executes arbitrary code in the agent's shell context with the agent's permissions.

🔄 Steps to Reproduce

1. Create a repository with an openspec/config.yaml containing a malicious rules.verify.test_command
2. Run the sdd-verify skill against that repository
3. The skill reads and executes the command string from the config file

✅ Expected Behavior

The skill should only execute a fixed allowlist of trusted, built-in commands per detected language (e.g. npm test, pytest, go test ./...) and never execute command strings sourced from repository files.

❌ Actual Behavior

The skill executes whatever string is defined in:

• openspec/config.yaml → rules.verify.test_command / rules.verify.build_command
• package.json → scripts.test / scripts.build
• Makefile → make test / make build

This allows arbitrary command injection via repo-controlled files.

---

🖥️ Environment

• Operating System: Windows
• Agent / Client: Claude Code
• Shell: bash

📋 Relevant Logs

N/A — design-level vulnerability, not a runtime crash.

💡 Additional Context

Recommended fix: Replace dynamic command detection with a fixed allowlist of safe commands per language, with a fallback that asks the orchestrator rather than executing repo-provided values. Add an explicit rule: NEVER execute command strings sourced from repository files (including openspec/config.yaml, package.json, Makefile, or similar).

Fix already implemented in fork: imperius361/agent-teams-lite@b06f5eb