The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from project files and tool outputs to guide implementation behavior. Specifically, it reads files specified in contextFiles and interprets context and operationGuidance fields from the openspec CLI output as prompt-level constraints.
Ingestion points: SKILL.md (Steps 3 and 4) describes reading contextFiles and parsing JSON metadata (context, operationGuidance) from the CLI.
Boundary markers: The skill lacks technical delimiters to separate untrusted data from system instructions, though it includes a logical rule to report conflicts between context and built-in instructions.
Capability inventory: The skill possesses file-write capabilities for implementation and shell execution via the openspec CLI tool.
Sanitization: A guardrail is present to prevent copying runtime context or guidance metadata directly into implementation files, but no structural validation is performed on the content itself.
[COMMAND_EXECUTION]: The skill executes shell commands using the openspec CLI. While scoped to the openspec:* namespace in allowed-tools, it incorporates user-supplied strings (change names, store IDs) into command arguments, which could be exploited if the CLI tool itself is vulnerable to argument injection.

openspec-apply-change