The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from several sources that could be used to deliver malicious instructions to the agent.
Ingestion points: The skill reads tasks.md, main specs (spec.md), and delta specs. It also executes openspec instructions which returns JSON containing context, operationGuidance, and rules fields intended to influence the prompt and behavior.
Boundary markers: The skill provides clear instructions to treat external guidance as "advisory" and "optional," explicitly telling the agent to keep these fields separate from built-in steps and to report conflicts rather than obeying conflicting external instructions.
Capability inventory: The skill has access to the Bash tool to execute openspec commands, can read/write local files, and can move directories (mv) within the project structure.
Sanitization: The instructions explicitly forbid inferring replacement paths, skipped prompts, or flags from the external guidance, and warn against copying the instruction text verbatim into output files.

openspec-archive-change