The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes shell commands using the openspec CLI. It interpolates user-provided strings, such as change names and store IDs, directly into command strings (e.g., openspec new change "<name>"). While the instructions direct the agent to derive a kebab-case name, the underlying pattern of shell command construction from user input poses a risk if sanitization is bypassed.
[DYNAMIC_EXECUTION]: The skill contains logic to delegate artifact creation to other skills or commands based on the content of the instruction field returned by the CLI at runtime (e.g., 'If the instruction field delegates creation to a specific skill or command, invoke it to produce the artifact'). This dynamic invocation of tools based on externally provided metadata represents a medium-severity dynamic execution risk.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (the openspec CLI, which in turn reads local project configuration and schemas). This content includes instructions and rules that the agent is told to follow as constraints. A malicious local project configuration could potentially influence agent behavior.
Ingestion points: Untrusted data enters the agent context via openspec instructions <artifact-id> --json and openspec status --json in SKILL.md.
Boundary markers: The skill lacks explicit boundary markers or 'ignore embedded instructions' warnings when processing the instruction, context, and rules fields.
Capability inventory: The skill has the capability to execute shell commands (Bash(openspec:*)) and write files to the filesystem.
Sanitization: There is no explicit sanitization shown for the content of the instructions returned by the CLI before the agent processes them.

openspec-propose