The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes shell commands via the openspec CLI using parameters derived from user input, such as <name>, <store-id>, and <schema-name>. While the instructions advise deriving a 'kebab-case name', there is a risk of command injection if the agent fails to strictly sanitize these inputs before passing them to the Bash tool.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface by ingesting untrusted data from both user descriptions and the output of CLI commands to generate project artifacts.
- Ingestion points: User-provided build descriptions, output from openspec status --json, and output from openspec instructions --json.
- Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded commands within the ingested data.
- Capability inventory: Full access to the openspec CLI (via Bash(openspec:*)), as well as file system read and write capabilities.
- Sanitization: The skill only specifies a transformation to 'kebab-case' for the change name, but does not provide validation or sanitization for other interpolated fields like store IDs or schema names.
[DYNAMIC_EXECUTION]: The skill implements logic to dynamically delegate the creation of artifacts to other skills or commands based on the instruction field returned by the openspec CLI at runtime. This allows the behavior of the skill to be modified by external tool output, potentially leading to the execution of unintended commands or scripts.

openspec-propose