The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources that could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: In Step 5a, the skill reads data from openspec instructions --json (including instruction, rules, template, and context fields) and reads existing artifact files from the disk for context.
Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to ignore embedded commands when processing the template or instruction fields.
Capability inventory: The agent has the capability to write files to the local file system and execute shell commands via the openspec CLI.
Sanitization: No sanitization or validation is performed on the data fetched from the CLI or the files read from disk before they are processed by the agent.
[DYNAMIC_EXECUTION]: The skill allows an external tool to dynamically delegate the execution of other skills or commands.
Evidence: Step 5a explicitly instructs the agent: "If the instruction field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself." This creates a vector where compromised CLI output could lead the agent to execute unintended tools or commands.
[COMMAND_EXECUTION]: The skill's primary functionality is built upon the execution of external shell commands.
Evidence: Multiple steps involve running openspec commands (e.g., new change, status, instructions, context, schemas) using the Bash tool. Although restricted by allowed-tools in the frontmatter, the reliance on shell execution is a core part of the skill's risk profile.

openspec-propose