The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from several local files which could contain malicious instructions if those files are compromised.
Ingestion points: Data is read from openspec/changes/{change-id}/tasks.md, openspec/changes/{change-id}/proposal.md, and openspec/project.md in SKILL.md.
Boundary markers: No boundary markers or 'ignore' instructions are used when interpolating file content into prompts or updating CONTEXT-llm.md.
Capability inventory: The skill uses Bash, Edit, Write, Read, Glob, and Grep tools.
Sanitization: The skill does not describe any sanitization or filtering of the content read from these files.
[DYNAMIC_EXECUTION]: The skill generates shell commands by interpolating user-provided arguments.
Evidence: The commands sync, docs, and context in SKILL.md all utilize the pattern openspec status {change-id} where {change-id} is the user input.
Risk: A malicious change-id (e.g., containing shell metacharacters like ; or |) could potentially lead to command injection if not handled securely by the underlying agent platform.
[COMMAND_EXECUTION]: The skill relies on executing system commands to gather state and perform its tasks.
Evidence: Uses git status --short, git log, and the openspec CLI tool as defined in the command workflows.

openspec-sync