The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local repository and instructs the agent to follow guidance contained within that data, creating a surface for indirect prompt injection.
Ingestion points: The skill fetches data via openspec instructions archive --json (Step 1), openspec status --json (Step 2), tasks.md (Step 3), and openspec instructions specs --json (Step 4). Fields like context, operationGuidance, and rules are directly ingested into the prompt context.
Boundary markers: Absent. There are no explicit delimiters or warnings to the model to ignore potentially malicious instructions embedded in these external sources.
Capability inventory: The skill has access to the openspec CLI tool, can perform file system operations (mkdir, mv), and can trigger the openspec-sync-specs workflow.
Sanitization: Absent. The instructions explicitly direct the agent to "read and consider" the external context and "follow entries" of the guidance, which increases the likelihood of the agent obeying injected instructions.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute various openspec CLI commands and standard file system utilities like mkdir and mv. While these are consistent with the skill's stated purpose of archiving changes, they represent the capability set that could be abused via prompt injection.

openspec-archive-change