The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from the openspec instructions CLI command and treats the instruction field as authoritative guidance. This creates a surface where a malicious project repository could provide instructions that influence the agent's behavior. 1. Ingestion points: The skill executes the openspec instructions command and parses the instruction field from the resulting JSON in SKILL.md. 2. Boundary markers: The skill includes a 'Planning boundary' section to limit implementation actions, but explicitly instructs the agent to treat the external instruction field as the authoritative guidance for artifact creation. 3. Capability inventory: The skill utilizes the Bash(openspec:*) toolset and the ability to write files to paths resolved by the CLI. 4. Sanitization: There is no evidence of sanitization or validation of the content within the instruction field before the agent processes it.
[COMMAND_EXECUTION]: The workflow allows the content of the instruction field, which is derived from project files, to dictate the execution of specific skills or commands for artifact generation, enabling project-controlled dynamic behavior.

openspec-propose