The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements a workflow where the agent parses instructions from an external command's output (openspec instructions) to determine how to proceed. Specifically, step 5.a directs the agent that if the instruction field delegates creation to a "specific skill or command," it should "invoke it to produce the artifact." This represents the dynamic execution of commands determined at runtime from external data sources.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and acting upon instructions, context, and rules provided in JSON format by the openspec CLI.
Ingestion points: Data is ingested through openspec instructions <artifact-id> --change "<name>" --json and openspec status --change "<name>" --json in SKILL.md.
Boundary markers: The skill includes instructions to treat context and rules blocks as constraints and specifically not to copy them into the output files, which serves as a basic delimiter for the agent.
Capability inventory: The agent has the capability to execute shell commands via the Bash tool and write files to the local file system.
Sanitization: The skill instructs the agent to derive a kebab-case name from user input and to re-read dependencies from disk, but lacks formal sanitization of the structured data returned by the CLI.
[COMMAND_EXECUTION]: The skill heavily utilizes shell command execution with multiple interpolated variables, including <name>, <store-id>, <schema-name>, and <artifact-id>. While the instructions include guidance on formatting (e.g., kebab-case for the name), the direct interpolation of these variables into bash commands presents a potential risk for command injection if the underlying agent does not properly escape the inputs before execution.

openspec-propose