The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute git commands and a project-specific openspec CLI tool. It incorporates a user-supplied change-id argument directly into these shell interactions. This pattern introduces a potential command injection surface if the agent fails to sanitize shell metacharacters provided in the argument.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading and interpreting external data from files like proposal.md, tasks.md, and various specifications. These files represent an attack surface where malicious instructions could be embedded to influence the agent's audit results.
Ingestion points: Processes content from multiple markdown files within the openspec/changes/{change-id}/ directory structure.
Boundary markers: There are no explicit instructions for the agent to use delimiters or 'ignore' warnings to separate the file content from the agent's instructions during analysis.
Capability inventory: The skill is granted access to powerful tools including Bash for command execution and Edit for file modification, alongside standard Read, Grep, and Glob tools.
Sanitization: The skill does not define any mechanisms for sanitizing or validating the data extracted from the project files before it is processed to generate the reflection report.

openspec-reflect