The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and follow instructions provided by the openspec CLI tool, which creates a surface for indirect prompt injection if the project files or the tool's output are influenced by an attacker.
- Ingestion points: In SKILL.md (Step 3), the agent executes openspec instructions apply --change "<name>" --json and is instructed to parse the context and operationGuidance fields.
- Boundary markers: The instructions explicitly state that context is a "required prompt-level input" and operationGuidance is "optional additive advice." While the skill includes some logic to preserve the "controlling workflow inputs" and report conflicts, there are no structural delimiters (like XML tags or specific block quotes) or explicit instructions to ignore potentially malicious embedded directives within those specific fields.
- Capability inventory: The skill has the capability to execute shell commands via the Bash(openspec:*) tool and is expected to modify project source code and planning artifacts (Step 6).
- Sanitization: There is no evidence of sanitization, filtering, or validation of the content returned in the context or operationGuidance fields before the agent processes them as instructions.

openspec-apply-change