The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the openspec CLI and project repository, which could be exploited to provide malicious instructions that influence the agent's behavior during task implementation.
Ingestion points: The agent ingests content from the context and operationGuidance fields returned by the openspec instructions apply command, as well as the content of project files listed in the contextFiles output (SKILL.md, Step 3 and Step 4).
Boundary markers: The skill contains detailed instructions directing the agent to maintain a clear distinction between advisory guidance and the CLI's authoritative state, specifically requiring the agent to report conflicts and prevent guidance from bypassing blocked states.
Capability inventory: The skill uses a scoped Bash tool (restricted to openspec commands) and has the ability to write to the file system to modify project source code and update task progress (SKILL.md, Step 6).
Sanitization: While no automated sanitization is described, the skill uses instructional guardrails to prevent the agent from treating external guidance as proof of completion or copying it into implementation files without authorization.

openspec-apply-change