The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell commands using the openspec CLI, incorporating variables derived from user input.
Evidence: Commands such as openspec new change "<name>" and openspec status --change "<name>" in SKILL.md use the <name> variable. The skill mitigates this risk by instructing the agent to derive a kebab-case version of the user's description.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted JSON data from external CLI calls and uses it to direct the agent's behavior, creating a vulnerability to indirect instructions.
Ingestion points: Output from openspec instructions <artifact-id> --change "<name>" --json and openspec status --change "<name>" --json in SKILL.md.
Boundary markers: Absent; the agent is instructed to follow the instruction field directly.
Capability inventory: The skill has access to the Bash(openspec:*) tool and file system write capabilities via resolvedOutputPath.
Sanitization: Absent; the skill does not specify any validation or filtering for the content of the instruction or context fields before processing.
[DYNAMIC_EXECUTION]: The skill instructions allow the agent to execute arbitrary skills or commands if directed by the output of the CLI tool.
Evidence: Step 5a in SKILL.md states: "If the instruction field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself". This allows runtime determination of executed commands by the external tool's output.

openspec-propose