Security Considerations

Trust Model

Extensions run with same privileges as AI agent:

• Can execute shell commands
• Can read/write files in project
• Can make network requests

Trust boundary: User must trust extension author.

Verification

Verified Extensions (in catalog):

• Published by known organizations (GitHub, Stats Perform, etc.)
• Code reviewed by spec-kit maintainers
• Marked with ✓ badge in catalog

Community Extensions:

• Not verified, use at own risk

• Show warning during installation:

  ⚠️  This extension is not verified.
     Review code before installing: https://github.com/...
  
     Continue? (yes/no):

Sandboxing (Future)

Phase 2 (not in initial release):

• Extensions declare required permissions in manifest
• CLI enforces permission boundaries
• Example permissions: filesystem:read, network:external, env:read

# Future extension.yml
permissions:
  - "filesystem:read:.specify/extensions/jira/"  # Can only read own config
  - "filesystem:write:.specify/memory/"          # Can write to memory
  - "network:external:*.atlassian.net"           # Can call Jira API
  - "env:read:SPECKIT_JIRA_*"                    # Can read own env vars

Package Integrity

Future: Sign extension packages with GPG/Sigstore

# catalog.json
"jira": {
  "download_url": "...",
  "checksum": "sha256:abc123...",
  "signature": "https://github.com/.../spec-kit-jira-1.0.0.sig",
  "signing_key": "https://github.com/statsperform.gpg"
}

CLI verifies signature before extraction.