The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, user-controlled files to provide context for its analysis. This creates a surface for indirect prompt injection attacks.
Ingestion points: Reads project configuration from openspec/config.yaml or openspec/config.yml, and existing artifacts from paths defined in artifactPaths.
Boundary markers: The instructions explicitly warn the agent not to copy content from these files into the conversation or new artifacts, which serves as a behavioral boundary but not a technical one.
Capability inventory: The skill utilizes the openspec CLI via Bash to list, read, and write project artifacts.
Sanitization: There is no mention of programmatic sanitization or validation of the content read from these external files.
[COMMAND_EXECUTION]: The skill dynamically constructs shell commands by interpolating user-provided strings, such as change names and store IDs, into CLI arguments (e.g., openspec new change "<name>"). While the allowed-tools configuration restricts execution to the openspec binary, malicious input containing shell metacharacters could potentially lead to argument injection or unexpected command behavior if not correctly handled by the underlying platform and CLI tool.

openspec-explore