The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data that could contain instructions designed to subvert the agent's logic.
Ingestion points: The skill reads files identified in the contextFiles array (Step 4) and interprets natural language fields like context and operationGuidance returned by the openspec instructions apply command (Step 3).
Boundary markers: The instructions include conceptual boundaries (e.g., "Treat context as a required prompt-level input", "report the conflict") but no physical markers or sanitization are applied to the external data before it is read into the context.
Capability inventory: The agent has the capability to modify local files (Step 6) and execute a variety of openspec CLI commands via the Bash tool.
Sanitization: No explicit sanitization or filtering is performed on the content of the context files or the guidance fields provided by the external project.
[COMMAND_EXECUTION]: The skill uses the Bash(openspec:*) tool to execute CLI commands. While the tool is scoped to the openspec namespace, it processes user-provided change names and store IDs as arguments (e.g., openspec status --change "<name>" --store "<id>"). Although the instructions use double quotes for these variables, there is a potential for command injection if the underlying platform does not properly sanitize these inputs.

openspec-apply-change