The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from the openspec CLI outputs, specifically the context and operationGuidance fields returned by the instructions command. This represents a tool-output poisoning surface where external data is treated as prompt-level input.
Ingestion points: SKILL.md (Steps 2, 3, and 4) ingests data from openspec status, openspec instructions, and the content of files identified in contextFiles.
Boundary markers: Absent. While the skill instructs the agent to keep external guidance separate from system instructions and to report conflicts, no formal character-based delimiters (e.g., XML tags) are specified for the parsing of the CLI output.
Capability inventory: SKILL.md (Step 6) performs file system writes to implement code changes, and the skill is authorized to use the Bash(openspec:*) tool.
Sanitization: Absent. The skill does not mandate specific sanitization of the CLI output before interpolation into the prompt.
[COMMAND_EXECUTION]: The skill executes the openspec CLI tool via Bash. While the tool usage is restricted to the openspec namespace in allowed-tools, the command arguments are dynamically constructed based on user input and previous CLI outputs, which is a standard functional requirement for this skill type.

openspec-apply-change