The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements a pattern where it dynamically invokes commands or other skills based on data received at runtime.
Evidence: In SKILL.md, step 5a states: "If the instruction field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself". This allows the output of an external tool to dictate which commands the agent executes, which is a significant security risk if the tool's configuration or the data it processes is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted data from multiple sources.
Ingestion points: The skill reads existing project artifact files (markdown) and processes JSON output from the openspec CLI (status and instructions).
Boundary markers: There are no explicit delimiters or boundary markers used when reading these files to prevent embedded instructions from influencing the agent's behavior.
Capability inventory: The agent has the capability to write files to the filesystem and execute shell commands via the openspec CLI.
Sanitization: The skill lacks any mentioned sanitization, validation, or filtering of the content read from external project files or tool outputs before they are used to guide subsequent actions.
[COMMAND_EXECUTION]: The skill performs frequent command execution via Bash, targeting the openspec binary.
Evidence: The skill uses openspec new change, openspec status, openspec instructions, and openspec context. While restricted to the openspec namespace by the platform configuration, the parameters for these commands (such as change names and store IDs) are derived directly from user input or project data, creating a potential path for argument injection if the CLI tool does not handle input safely.

openspec-propose