The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically executes commands or specific skills based on the instruction field returned by the openspec instructions tool. If the project configuration or CLI output is compromised, this could lead to the execution of unintended or dangerous commands.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data including instruction, rules, and context fields from the openspec CLI output. This creates a vulnerability surface where a malicious project repository could provide instructions designed to subvert the agent's safety guidelines or original task.
Ingestion points: The skill reads JSON output from the openspec instructions command (SKILL.md, step 5a).
Boundary markers: While the skill warns the agent not to include context and rules in the output, it lacks formal delimiters (like XML tags or unique markers) to prevent the LLM from confusing instructions for data.
Capability inventory: The agent has permissions to execute openspec CLI commands and write files to the local file system.
Sanitization: There is no evidence of input validation or sanitization performed on the content retrieved from the CLI before it is processed by the agent.
[COMMAND_EXECUTION]: The skill performs multiple shell operations using the openspec CLI, passing arguments such as change names and store IDs derived from user input and CLI output.

openspec-propose