The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by interpolating variables into strings, such as openspec status --change "<name>" --json. If the <name> variable, which can be provided by the user, contains shell metacharacters (e.g., ;, &&, or backticks), it could lead to arbitrary command execution on the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external markdown artifacts which may be controlled by third parties or attackers.
Ingestion points: The skill reads contents from files identified as tasks, specs, and design artifacts (e.g., tasks.md, specs.md, design.md) located within the target repository.
Boundary markers: While the skill looks for specific markdown headers like ### Requirement: and #### Scenario:, it does not implement explicit boundary markers or instructions to ignore embedded agent commands within those sections.
Capability inventory: The skill has the ability to execute shell commands via the openspec CLI tool and perform filesystem searches across the codebase.
Sanitization: There is no evidence of sanitization or validation of the content extracted from the spec files before it is used to guide the agent's verification logic.

openspec-verify-change