The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing shell commands through the openspec CLI (e.g., openspec new change, openspec status, openspec instructions) to perform its primary function. While the allowed-tools configuration attempts to restrict this to the openspec namespace, command execution remains a core capability.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from external sources, which creates a vulnerability surface for indirect prompt injection.
Ingestion points: Processes output from openspec instructions <artifact-id> --json and re-reads artifact files (like proposal.md or specs/) from the local disk.
Boundary markers: The instructions include explicit directives to treat certain blocks (like <context> and <rules>) as internal constraints rather than content for output, which serves as a basic boundary but does not prevent adversarial injection.
Capability inventory: The agent has the ability to write files to the local file system (resolvedOutputPath) and execute CLI commands via Bash.
Sanitization: No explicit sanitization, validation, or escaping of the ingested instructions or file content is performed before the agent uses them to generate new artifacts.
[DYNAMIC_EXECUTION]: The workflow contains logic in Step 5a that instructs the agent to dynamically invoke a specific command or skill if directed by the instruction field within the JSON output of openspec instructions. Executing commands determined at runtime by external data is a significant security risk.

openspec-propose