The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from external files and tool outputs which may contain instructions that influence agent behavior.
Ingestion points: The agent reads existing artifact files (dependencies) from the disk and parses the instruction field provided by the openspec instructions command output (SKILL.md, Step 5a).
Boundary markers: The skill includes explicit instructions for the agent to treat context and rules from tool outputs as constraints rather than content for the output file, although it lacks unique delimiters for data read from disk.
Capability inventory: The agent is authorized to write files to paths resolved at runtime and execute subcommands of the openspec CLI.
Sanitization: There is no evidence of programmatic sanitization or validation of the content retrieved from the CLI tool or local files before it is processed by the LLM.
[DYNAMIC_EXECUTION]: The skill can dynamically determine and execute commands based on data provided at runtime.
Execution pattern: Step 5a explicitly directs the agent to "invoke [a specific skill or command] to produce the artifact" if requested by the instruction field in the CLI output, rather than writing the file itself.
Scope: While this represents dynamic tool invocation, the risk is scoped by the platform configuration which restricts the agent to the openspec toolset.

openspec-propose