The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied descriptions and reads local artifact files to generate new planning documents. These files act as ingestion points for untrusted data that could influence the agent's behavior.
Ingestion points: The workflow reads completed dependency files (e.g., proposal.md, spec.md) from the filesystem to provide context for subsequent steps in SKILL.md.
Boundary markers: The skill lacks explicit instructions or delimiters to isolate data from instructions within the processed files.
Capability inventory: The skill uses the Bash tool to execute openspec CLI commands and writes markdown files to the project directory.
Sanitization: No specific sanitization or validation logic is applied to the content of the dependency files before they are read as context.
[COMMAND_EXECUTION]: The skill executes shell commands that include user-provided strings.
Commands like openspec new change "<name>" interpolate user-derived names directly into the command line. Although the agent is instructed to use kebab-case, this pattern remains a potential vector for command injection if input validation is insufficient.

openspec-propose