The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to command injection through unsafe interpolation of user-controlled variables into shell commands. Specifically, the <name>, <store-id>, and <schema-name> inputs are placed inside double quotes in commands like openspec new change "<name>" and openspec status ... --store "<id>". A malicious user could provide an input such as "; openspec doctor; # to break out of the intended command and execute arbitrary subcommands allowed by the openspec:* filter.
[DYNAMIC_EXECUTION]: The skill implements a dangerous dynamic execution pattern where it retrieves instructions from the openspec instructions command and explicitly directs the agent to execute any specific skill or command delegated by those instructions. This allows the external openspec CLI tool or the data it processes (e.g., project configuration) to exercise full control over the agent's actions within the allowed tool scope.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it processes instructions and context from the project environment via CLI tools without adequate sanitization or boundary markers.
Ingestion points: Data retrieved from openspec instructions <artifact-id> --change "<name>" --json (specifically the instruction, context, rules, and template fields) in SKILL.md.
Boundary markers: None. The skill instructs the agent to apply the retrieved context and rules directly as constraints without any delimiters to separate instructions from data.
Capability inventory: The agent has access to the Bash tool with a wildcard prefix openspec:*, which allows for significant file system and configuration operations.
Sanitization: No evidence of escaping or validation of the content returned by the CLI before it is processed by the agent.

openspec-propose