The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources and processes it as instruction or context, making it susceptible to indirect prompt injection.
Ingestion points: The skill reads user-supplied descriptions and names in Step 1, and re-reads artifact files from disk in Step 5a (e.g., proposal.md, design.md).
Boundary markers: There are no explicit delimiters or boundary instructions used when interpolation user input or file content into the agent's logic.
Capability inventory: The skill possesses the Bash(openspec:*) capability, allowing it to perform file operations and execute CLI commands.
Sanitization: The skill does not specify any sanitization or validation logic for the content read from disk or the user before it is used to drive the workflow.
[COMMAND_EXECUTION]: The skill constructs shell commands using variables derived directly from user input, such as openspec new change "<name>" and openspec status --change "<name>". While the platform limits commands to the openspec prefix, unsanitized input in shell arguments can lead to command injection if the user provides special characters or subcommands (e.g., using backticks or $()).
[DYNAMIC_EXECUTION]: In Step 5a, the skill's logic explicitly follows a delegation pattern: 'If the instruction field delegates creation to a specific skill or command, invoke it to produce the artifact'. This allows the content of the instruction field (which comes from the openspec CLI tool's evaluation of the project files) to trigger the execution of arbitrary commands or skills within the agent's environment.

openspec-propose