The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch instructions and guidance from an external source (via openspec instructions commands) and explicitly directs the agent to apply these project-specific facts, conventions, and rules to its workflow.
Ingestion points: SKILL.md Step 1 calls openspec instructions archive --change "<name>" --json and Step 4 calls openspec instructions specs --change "<name>" --json.
Boundary markers: The instructions provide logic to prioritize built-in checks and report conflicts, but the agent is still told to "read and consider" and "apply" content from the external JSON.
Capability inventory: The skill utilizes the Bash tool to modify the filesystem (mkdir, mv) and invokes the openspec-sync-specs sub-workflow.
Sanitization: There is no mention of strict schema validation or filtering for the fetched JSON before it is incorporated into the prompt context.
[COMMAND_EXECUTION]: The skill generates shell commands using variables such as <name>, <id>, and <target-name> which are derived from user input or conversation context. While these variables are wrapped in double quotes, they could potentially be exploited for command injection if the user provides crafted input containing shell metacharacters.
Evidence: Shell commands in Step 1, 2, and 5 use interpolated variables, such as openspec status --change "<name>" --json --store "<id>" and mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>".

openspec-archive-change