The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon external data provided by the openspec CLI output.
Ingestion points: The agent is explicitly instructed to parse context and operationGuidance fields from the JSON output of openspec instructions apply --json. It also reads multiple files listed in the contextFiles array returned by the CLI.
Boundary markers: The instructions mention keeping these fields separate from CLI-returned state and completion criteria, and treating them as "prompt-level behavior contracts." However, there are no structural delimiters (like XML tags or specific markdown blocks) to prevent the ingested data from containing instructions that override the agent's primary goals.
Capability inventory: The skill has the ability to execute openspec CLI commands via Bash and modify local files (e.g., marking tasks as complete in markdown files).
Sanitization: There is no mention of sanitizing or validating the content of the context or guidance fields before they are adopted as instructions by the agent.
[COMMAND_EXECUTION]: The skill dynamically constructs shell commands by interpolating variables such as <name> (change name) and <id> (store ID) into bash command strings (e.g., openspec status --change "<name>" --json --store "<id>"). While the instructions recommend using double quotes around these values, a malicious user or a compromised project configuration providing a specially crafted name could attempt to inject additional shell arguments or command segments.

openspec-apply-change