The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and act upon data retrieved from external project files and command outputs, which creates a surface for indirect prompt injection.
Ingestion points: The skill reads context and operationGuidance from the JSON output of openspec instructions archive, rules from openspec instructions specs, and processes the content of tasks.md. These inputs are intended to influence the agent's behavior and decisions during the archive workflow.
Boundary markers: The instructions contain logical constraints (e.g., stating that rules should only affect specification content and not CLI behavior), but there are no technical boundary markers or strict sanitization routines to prevent the LLM from being influenced by adversarial content embedded in these sources.
Capability inventory: The skill possesses the ability to execute CLI commands (openspec) and perform file system operations (mkdir, mv) which could be misused if the agent is successfully injected.
Sanitization: The skill does not perform explicit sanitization or filtering of the external guidance text before it is used to influence the prompt.
[COMMAND_EXECUTION]: The skill executes shell commands to perform its core archiving functions.
The skill uses Bash(openspec:*) for primary operations as defined in the allowed-tools metadata.
It also utilizes standard shell utilities like mkdir -p to create archive structures and mv to relocate the change root directory.
These commands are executed based on paths resolved from project configuration files and command outputs (planningHome.changesDir, changeRoot).

openspec-archive-change