The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes untrusted data from project files and CLI outputs.
Ingestion points: The skill reads files identified in the contextFiles output of the openspec instructions command and processes context and operationGuidance fields from the tool's JSON responses.
Boundary markers: The instructions include strong explicit boundary markers, directing the agent to keep external inputs separate from the CLI-returned workflow state and forbidding external data from being used to bypass blocked states or replace built-in instructions.
Capability inventory: The skill is limited to the Bash(openspec:*) toolset, allowing it to interact with the file system and the openspec CLI within its scope.
Sanitization: The skill mandates that the agent report conflicts between external project facts and core instructions, ensuring the controlling workflow values are preserved rather than blindly following potentially malicious injected content.

openspec-apply-change