The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it is designed to ingest and act upon instructions provided by external configuration files and tool outputs.
Ingestion points: The agent reads project background and rules from openspec/config.yaml, analyzes the project codebase, and follows template and instruction data returned by the openspec instructions CLI command.
Boundary markers: The instructions do not specify explicit delimiters or provide guidance for the agent to distinguish between legitimate system instructions and potentially malicious commands embedded in the processed data.
Capability inventory: The skill utilizes the Bash tool (restricted to openspec commands) to read local files, track project state, and write artifacts to the filesystem.
Sanitization: There is no evidence of validation or sanitization of the content retrieved from configuration files or CLI instruction fields before the agent processes them.

openspec-explore