The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates user-controlled strings, such as change names and directory paths, directly into Bash commands (e.g., openspec status --change "<name>" and mv "<changeRoot>" ...). While these variables are enclosed in double quotes, they are not sanitized to prevent subshell execution or command substitution (e.g., using backticks), which could allow an attacker to execute arbitrary code if they control the change name or planning home path.
[INDIRECT_PROMPT_INJECTION]: The skill is explicitly designed to ingest instructions from external sources and apply them to its workflow, creating a vulnerability to malicious content embedded in project data.
Ingestion points: The skill executes openspec instructions archive in Step 1 and openspec instructions specs in Step 4 to load external context and rules from project specifications.
Boundary markers: Absent. The skill does not implement delimiters or safety instructions to prevent the agent from mistaking data-based instructions for system-level commands.
Capability inventory: The skill has access to the Bash tool to perform file system manipulations (mkdir, mv) and execute CLI commands.
Sanitization: Absent. The agent is directed to "read and consider" the external content and "follow entries that are applicable and compatible."

openspec-archive-change