The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources that could contain malicious instructions or attempt to manipulate agent behavior.
Ingestion points: The skill reads output from openspec list, openspec status, and openspec instructions commands, as well as contents from tasks.md and project spec files (spec.md).
Boundary markers: The instructions provide a framework to isolate operationGuidance and context from the core workflow, explicitly noting that they are advisory and should not override controlling inputs.
Capability inventory: The agent is authorized to execute openspec CLI commands and shell utilities including mkdir and mv.
Sanitization: The instructions lack explicit sanitization or escaping for the <name> parameter or the directory paths extracted from the JSON outputs.
[COMMAND_EXECUTION]: The skill executes shell commands (mkdir -p and mv) using directory paths (planningHome.changesDir and changeRoot) that are dynamically retrieved from the openspec status CLI output. If the project configuration is maliciously manipulated, this could cause the agent to move files to unauthorized or sensitive system locations.

openspec-archive-change