The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the user-provided {change-id} argument directly in shell commands, which allows for command injection if the input contains shell metacharacters (e.g., ; rm -rf /).\n
Evidence: The sync, docs, and context commands in SKILL.md all instruct the agent to run openspec status {change-id} where {change-id} is derived from $ARGUMENTS.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it reads content from external files and uses that content to perform automated tasks or update other files.\n
Ingestion points: openspec/changes/{change-id}/tasks.md, openspec/changes/{change-id}/proposal.md, and openspec/project.md (referenced in SKILL.md).\n
Boundary markers: Absent. No instructions are provided to the agent to ignore or delimit potentially malicious instructions within the processed files.\n
Capability inventory: The skill has access to powerful tools including Bash, Write, Edit, Read, Glob, and Grep.\n
Sanitization: Absent. The workflow reads external file content and directly incorporates it into updates for CONTEXT-llm.md and documentation files.

openspec-sync