The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon context and operationGuidance fields provided by the openspec CLI tool, which may process untrusted data from project repositories.
Ingestion points: The skill reads context and operationGuidance from the JSON output of the openspec instructions apply command as described in SKILL.md (Step 3).
Boundary markers: Present. The instructions include explicit directives to keep these fields separate from core CLI state, to prioritize the built-in workflow in case of conflict, and to report any such conflicts to the user.
Capability inventory: The skill utilizes Bash(openspec:*) to execute CLI commands, performs file system read operations for context files, and modifies files to mark tasks as complete and implement code changes (referenced in SKILL.md Steps 4 and 6).
Sanitization: Present. The skill contains specific guardrails forbidding the copying of runtime guidance or context into implementation files or planning artifacts, preventing the persistence of potentially injected instructions.

openspec-apply-change