The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute openspec commands. While the allowed-tools configuration restricts execution to commands starting with openspec:*, a potential risk of command injection exists if user-provided change names containing shell metacharacters are not sanitized before interpolation into CLI arguments (e.g., in openspec status --change "<name>").
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it ingests and processes data fields (context and operationGuidance) from external CLI tool outputs as prompt-level instructions. The skill includes specific defensive instructions in SKILL.md (Step 3) to treat these fields as separate from core workflow state and to prioritize 'controlling' workflow values, which serves as a mitigation. Ingestion points: openspec instructions apply output; Capability inventory: openspec command execution and file modification.

openspec-apply-change