The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface where it ingests untrusted data from both tool outputs and local files to determine its subsequent actions. If an attacker can influence the output of the openspec tool or the content of project files, they might be able to redirect the agent's behavior.
Ingestion points: The skill reads JSON output from openspec instructions and openspec status, and it re-reads dependency files from the local disk.
Boundary markers: The instructions include explicit warnings for the agent to treat certain fields (context and rules) as constraints and not to include them in the generated output files, which serves as a basic delimiter against accidental obedience.
Capability inventory: The skill has permissions to write files to disk (resolvedOutputPath), execute the openspec CLI tool, and potentially invoke other skills or commands as directed by the instruction field from the tool's output.
Sanitization: There is no explicit sanitization or validation logic described for the content retrieved from the CLI tool or the local files before it is used to generate new artifacts.
[COMMAND_EXECUTION]: The skill frequently executes the openspec CLI tool via Bash. While these commands are generally scoped, they use arguments such as change names, schema names, and store IDs which are derived from user input or project context, presenting a standard command interpolation surface.

openspec-propose