The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local files within the openspec/changes/ directory to update core specifications. This creates an attack surface where maliciously crafted instructions inside the 'change' files could attempt to influence the agent's behavior during the update process.
Ingestion points: Reads task status from tasks.md and applies specification deltas from files located in openspec/changes/<id>/ (SKILL.md).
Boundary markers: Absent. The instructions do not define delimiters or provide warnings to the agent to disregard instructions potentially embedded within the data files.
Capability inventory: The skill is authorized to use Bash, Write, and Edit tools to move directories and modify files in the openspec/specs/ directory.
Sanitization: Absent. There are no steps described to validate or sanitize the content of the change deltas before they are integrated into the main specifications.

openspec-archive