The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest data from the output of openspec instructions commands and explicitly follow the directions contained in the context, operationGuidance, and rules fields. This creates a surface where content within the repository (which might be attacker-controlled) can influence or override the agent's core behavioral instructions.
Ingestion points: JSON output from openspec instructions archive --change "<name>" --json (Step 1) and openspec instructions specs --change "<name>" --json (Step 4).
Boundary markers: Absent. The skill does not provide clear delimiters or "ignore embedded instructions" warnings to the agent when processing this data.
Capability inventory: The agent has the ability to execute file system operations (mkdir, mv) and run various openspec CLI commands.
Sanitization: Absent. There is no validation or filtering of the fetched instruction data before the agent is told to apply it.
[COMMAND_EXECUTION]: The skill constructs shell commands by interpolating variables like <name>, <id>, and <target-name> into string templates (e.g., openspec status --change "<name>"). While these variables are enclosed in double quotes, the instructions do not require the agent to sanitize these inputs against shell metacharacters, which could lead to command injection. Additionally, the skill utilizes mkdir and mv commands in Step 5, which appears to bypass the allowed-tools: Bash(openspec:*) restriction defined in the YAML frontmatter, indicating a potential policy enforcement failure or configuration inconsistency.

openspec-archive-change