The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources (local artifact files and CLI-provided instruction sets) to generate new content. This ingestion of untrusted or externally-influenced data presents a vulnerability surface.
Ingestion points: The skill reads project files (e.g., specs/spec.md, design.md) and JSON data returned by openspec instructions, which includes context, rules, and instruction fields.
Boundary markers: The instructions do not specify the use of delimiters or boundary markers when interpolating data from these files into the agent's context.
Capability inventory: The skill possesses file-writing capabilities (to resolvedOutputPath) and shell command execution via the openspec CLI.
Sanitization: There is no evidence of content validation or sanitization of the data retrieved from local files or CLI outputs before use.
[COMMAND_EXECUTION]: The skill relies on the execution of the openspec CLI tool via Bash to perform various project management tasks, including creating changes, listing stores, and retrieving status.
[DYNAMIC_EXECUTION]: The instructions mandate that if the instruction field from the CLI response delegates creation to a specific command or skill, the agent should invoke that command dynamically at runtime.

openspec-propose