The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted data from multiple sources to generate project artifacts. A malicious user or a repository containing compromised planning files could attempt to influence the agent's output or logic through these ingestion points.
Ingestion points: User-provided change descriptions, output from the openspec instructions command (including context, rules, and instruction fields), and existing project files/artifacts read from the local disk (e.g., proposal.md, specs, design.md).
Boundary markers: The skill includes a defined 'Planning boundary' and instructions to clarify material ambiguity with the user before proceeding, which helps mitigate accidental deviations from the intended task.
Capability inventory: The skill has the capability to execute openspec CLI commands via the Bash tool and perform file read/write operations within the project directory.
Sanitization: There is no explicit sanitization or validation logic described for the content received from the CLI or local files before it is used to construct new artifacts.
[COMMAND_EXECUTION]: The skill performs automated command execution by invoking the openspec CLI tool with parameters derived from user input (e.g., change names, schema names, and store IDs). While these commands are scoped to the openspec toolset, the execution of commands based on external input represents a potential attack surface.

openspec-propose