The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to manage the file system, including creating directories (mkdir -p) and moving project data (mv). It also heavily utilizes the openspec CLI to query project state and metadata.
[INDIRECT_PROMPT_INJECTION]: The skill is configured to ingest external data from command outputs and local files, such as tasks.md, and is explicitly instructed to "read and consider" and "apply relevant project facts, conventions, and constraints" found therein. This creates a surface where malicious instructions in project metadata could influence agent behavior.
Ingestion points: Ingests JSON output from openspec instructions archive and openspec instructions specs, as well as the contents of tasks.md and delta specs.
Boundary markers: The instructions include a requirement to report conflicts and preserve "controlling inputs," which acts as a logical boundary, though it relies on the agent's reasoning rather than strict technical enforcement.
Capability inventory: The skill has permissions to write to the file system (via the sync workflow), move directories, and execute vendor CLI commands.
Sanitization: There is no evidence of explicit sanitization or schema enforcement on the natural language "guidance" or "context" fields retrieved from external sources.

openspec-archive-change