The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data returned by the openspec CLI, such as artifact instructions, rules, and templates. This data acts as an ingestion point for potentially untrusted instructions if a user connects the tool to an attacker-controlled store or repository.
Ingestion points: Data retrieved from openspec instructions <artifact-id> --json and content of dependency files read from the local file system.
Boundary markers: The instructions explicitly tell the agent that the instruction field is "authoritative guidance," which may lead the agent to follow malicious commands embedded in the data without sufficient isolation.
Capability inventory: Execution of openspec subcommands via Bash and writing content to the project's file system.
Sanitization: There is no evidence of sanitization for the instructions or templates retrieved from the CLI tool.
[DYNAMIC_EXECUTION]: The skill contains logic to invoke specific skills or commands based on the content of the instruction field retrieved at runtime. While these calls are limited to the openspec:* namespace, the behavior is determined by external data rather than static instructions.
[COMMAND_EXECUTION]: The skill relies on executing shell commands via the openspec CLI. Although restricted to a specific tool scope in the frontmatter, it handles user-provided inputs such as change names and schema names which are interpolated into shell commands.

openspec-propose