The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill explicitly fetches data from external, project-controlled sources and instructs the agent to incorporate that data into its decision-making process. This creates a surface where an attacker contributing to a repository could influence the agent's actions.
Ingestion points: Found in SKILL.md Step 1 (openspec instructions archive --change "<name>" --json) and Step 4 (openspec instructions specs --change "<name>" --json).
Boundary markers: The skill includes instructions to treat external guidance as "advisory" and "optional," and specifically directs the agent to prioritize built-in steps and command contracts over external advice. However, it still requires the agent to "read and consider it, and apply relevant project facts, conventions, and constraints."
Capability inventory: The skill has access to Bash(openspec:*), which includes the ability to list changes, show status, archive directories, and move files (mv). It also initiates the openspec-sync-specs workflow inline.
Sanitization: There is no explicit sanitization of the JSON content fetched from the CLI before it is processed by the agent's logic.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute openspec CLI commands, as well as standard filesystem operations like mkdir and mv to manage the project's archive structure.

openspec-archive-change