The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted data from external project files and CLI outputs.
Ingestion points: The skill reads context and operationGuidance fields from the JSON output of openspec instructions apply. It also reads multiple file paths listed in contextFiles.
Boundary markers: The instructions include explicit behavioral boundaries, directing the agent to 'Keep both fields separate from CLI-returned state', 'preserve the controlling value' in case of conflicts, and stating that these inputs 'do not permit bypassing a blocked state'.
Capability inventory: The agent has the capability to execute openspec CLI commands via Bash, read arbitrary local files within the project context, and modify files (specifically marking tasks as complete).
Sanitization: The skill implements a priority system where built-in instructions and CLI-controlled states override external guidance. It also explicitly forbids copying runtime context or guidance into implementation files.
[COMMAND_EXECUTION]: The skill relies on the Bash(openspec:*) tool to interact with the local system.
Evidence: The skill executes commands like openspec status, openspec list, and openspec instructions using arguments derived from user input (--change "<name>", --store "<id>"). While the instructions use double-quotes to suggest parameter encapsulation, the processing of user-provided strings in shell commands remains a standard vulnerability surface.

openspec-apply-change