The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external project files and CLI outputs which could contain malicious instructions meant to subvert the agent's workflow.
Ingestion points: The skill reads the output of openspec instructions archive --json (specifically the context and operationGuidance fields) and parses the content of the tasks.md file.
Boundary markers: The instructions include explicit guardrails, telling the agent to keep external guidance separate from built-in steps, treat it as advisory, and report/ignore conflicts with the core workflow.
Capability inventory: The skill has the ability to execute shell commands via the Bash tool, including moving directories and executing the openspec CLI.
Sanitization: There is no technical sanitization (e.g., HTML escaping or regex filtering) described, relying instead on the agent's ability to follow logic-based conflict resolution instructions.
[COMMAND_EXECUTION]: The skill dynamically constructs and executes shell commands using variables derived from project metadata and user input.
Evidence: The skill uses variables like <name>, <changeRoot>, and <planningHome.changesDir> inside shell command templates (e.g., mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"). While the instructions suggest using double quotes, this pattern presents a surface for command injection if the underlying data sources or user-provided names are not properly sanitized by the agent platform.

openspec-archive-change