The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to subvert the agent's behavior.
Ingestion points: The skill reads several files from the openspec/ directory, including project.md, proposal.md, design.md, tasks.md, tests.md, and various specification files in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the processed markdown artifacts.
Capability inventory: The skill is granted Bash and Agent tools in the allowed-tools frontmatter of SKILL.md, providing a high-impact execution environment if an injection occurs.
Sanitization: No sanitization, validation, or filtering of the content read from the openspec/ files is performed before it is processed by the agent.

openspec-review