The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions in Step 5a explicitly tell the agent to "invoke" a specific skill or command if directed by the instruction field retrieved from the openspec CLI tool. This allows for runtime command generation and execution based on data returned by an external process.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it processes data from multiple external sources. 1. Ingestion points: Reads instructions, templates, and path information from the openspec CLI tool output in SKILL.md (Step 4 and 5), reads content from existing project files (dependencies) in Step 5a, and accepts user-provided change names and descriptions. 2. Boundary markers: The skill lacks explicit markers or "ignore instructions" delimiters when processing data from the CLI or local files. 3. Capability inventory: The skill uses the Bash tool to execute openspec commands and performs file system operations (read/write) at resolvedOutputPath. 4. Sanitization: There is no mention of sanitizing or validating the instruction or template strings received from the CLI before they are used to guide agent behavior.
[COMMAND_EXECUTION]: The skill uses the Bash tool to interact with the openspec CLI, performing actions such as listing stores, creating changes, and querying status, which involves executing system-level commands.

openspec-propose