The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it explicitly instructs the agent to ingest and follow instructions from external sources.
Ingestion points: The skill reads JSON data from openspec instructions archive and openspec instructions specs, and reads the content of a local tasks.md file.
Boundary markers: While the instructions state that context and guidance should be kept separate from controlling inputs and conflicts should be reported, the skill also commands the agent to "read and consider it, and apply relevant project facts, conventions, and constraints," which allows external data to steer agent behavior.
Capability inventory: The agent can execute shell commands (mkdir, mv), use the openspec CLI tool, and invoke the openspec-sync-specs workflow inline.
Sanitization: No explicit sanitization or validation of the external content is required before the agent applies the rules or guidance to its execution flow.
[COMMAND_EXECUTION]: The skill performs file system modifications using standard shell commands (mkdir -p, mv). These commands use variables (planningHome.changesDir, changeRoot, target-name) that are dynamically populated from the output of the openspec status tool.

openspec-archive-change