The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions.
Ingestion points: The skill ingests data from the openspec instructions apply command (specifically the context and operationGuidance fields) and reads file content from paths listed in contextFiles (SKILL.md).
Boundary markers: The instructions include explicit directives to keep external guidance separate from the core workflow state and to preserve controlling values in the event of a conflict.
Capability inventory: The agent has access to the Bash tool (scoped to openspec:* commands) and the ability to read project files and write task completions back to the filesystem.
Sanitization: The skill contains explicit logic for the agent to report and ignore external guidance that conflicts with the built-in workflow or user choices.

openspec-apply-change