The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and processes data from external sources (the openspec CLI output and existing artifact files) to generate new content, creating a surface where malicious instructions in project data could influence the agent.
Ingestion points: The skill reads JSON data from openspec instructions and openspec status, and reads content from previously completed dependency files (SKILL.md Step 4).
Boundary markers: The instructions explicitly state that context and rules fields are constraints for the agent and must not be copied into the output files, which acts as a logical boundary.
Capability inventory: The skill has the ability to write files to the local file system and execute openspec CLI commands.
Sanitization: The skill does not describe specific sanitization for the content read from dependency files or CLI JSON output.
[COMMAND_EXECUTION]: The skill uses the openspec CLI to create and manage project changes, incorporating user-provided strings into shell commands.
Evidence: The skill executes commands like openspec new change "<name>" where <name> is derived from user input.
Mitigation: The skill includes a specific instruction to derive a kebab-case name (e.g., add-user-auth) from the user's description, which serves to sanitize the input before it is passed to the shell command.

openspec-ff-change