The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using the {change-id} placeholder (e.g., mkdir -p openspec/archive/{change-id}). If this identifier is provided by a user without proper sanitization, it could potentially allow command injection via shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external specification files and task lists, which could contain malicious instructions designed to influence the agent's behavior during the merge or archiving process.
Ingestion points: Reads data from openspec/changes/{change-id}/tasks.md and markdown files within openspec/changes/{change-id}/specs/.
Boundary markers: The skill does not use delimiters or explicit 'ignore embedded instructions' warnings when reading and writing specification content.
Capability inventory: The skill has access to the Bash tool for filesystem and Git operations, as well as Write and Edit tools for modifying source-of-truth documentation.
Sanitization: No validation, escaping, or filtering is applied to the content of the delta specs before they are merged into the main specification files.

openspec-archive