The Agent Skills Directory

[COMMAND_EXECUTION]: The skill builds shell commands using variables provided directly by the user or inferred from context, such as change names and store identifiers.
Evidence: The instructions specify running commands like openspec status --change "<name>" --json --store "<id>". This pattern creates a risk of command injection if the underlying execution environment does not properly sanitize or escape these parameters.
[DYNAMIC_EXECUTION]: The skill implements dynamic logic that allows runtime data to dictate which agent capabilities or tools are invoked.
Evidence: The skill is instructed to check an instruction field from the CLI's JSON output: "If the instruction field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself." This behavior allows the output of a local tool to control the agent's tool-calling behavior.
[INDIRECT_PROMPT_INJECTION]: The skill processes JSON data from the openspec CLI, which reads configuration from the local filesystem. A malicious project could provide adversarial content designed to influence the agent.
Ingestion points: The agent reads the context, rules, and instruction fields from openspec instructions <artifact-id> --change "<name>" --json.
Boundary markers: None. The instructions explicitly tell the agent to follow these fields as authoritative guidance and constraints.
Capability inventory: The agent can execute openspec CLI tools, write files to resolvedOutputPath, and invoke other agent skills.
Sanitization: None. The skill applies the external data as constraints without filtering or validation.

openspec-continue-change