The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads planning artifacts from the openspec/changes/ directory, including proposal.md, tasks.md, design.md, and spec.md. These files are interpreted by the agent to perform "Critical Analysis" and "Smart Conversion," making them potential vectors for indirect prompt injection where instructions hidden in these files could influence agent behavior.
Ingestion points: Multiple files in openspec/changes/<change>/ including proposal.md, tasks.md, specs/*/spec.md, and design.md as specified in SKILL.md under Context Gathering.
Boundary markers: Absent. The instructions do not prescribe the use of delimiters (like XML tags or triple quotes) or provide the agent with a safety warning to ignore instructions contained within the external files.
Capability inventory: The skill has the capability to execute shell commands including bd create, bd dep add, and openspec show via the agent's environment.
Sanitization: No evidence of sanitization, validation, or escaping of the content read from these files before it is processed or interpolated into command templates.
[COMMAND_EXECUTION]: The skill's primary function involves executing local CLI tools (openspec and bd) to retrieve specification data and create task tracking issues.
[DYNAMIC_EXECUTION]: The skill uses templates defined in templates/issue-creation.md to dynamically construct shell commands at runtime. Data extracted from the OpenSpec files (such as <task-description>) is interpolated into these commands before they are executed, which presents a surface for command injection if the source data is maliciously crafted.

openspec-to-beads