The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the openspec CLI tool (specifically the context and operationGuidance fields) and from files listed in contextFiles. This data is treated as prompt-level input and additive advice, which could be used to influence the agent's behavior if the project files or tool outputs contain malicious instructions.
Ingestion points: JSON output from openspec status and openspec instructions, as well as file content from paths specified in contextFiles (SKILL.md).
Capability inventory: Execution of openspec CLI commands and reading/writing local project files (SKILL.md).
Boundary markers: The instructions attempt to separate CLI-controlled state from external advice and forbid using this data to bypass blocked states, which acts as a partial mitigation.
Sanitization: There is no explicit sanitization or structural validation performed on the text content ingested from these external sources before it is processed by the agent.
[COMMAND_EXECUTION]: The skill relies on the openspec CLI tool to perform its primary functions. While restricted to the openspec namespace via the allowed-tools configuration, the agent executes shell commands using parameters derived from user input (the change name) and previous tool outputs.

openspec-apply-change