The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources and is explicitly instructed to follow instructions contained within that data.
Ingestion points: Data returned by the openspec instructions archive command in Step 1 contains context and operationGuidance fields.
Boundary markers: The instructions tell the agent to "read and consider" the external content and "apply relevant project facts, conventions, and constraints," although they note that conflicts with controlling inputs should be reported.
Capability inventory: The skill uses the Bash tool to execute CLI commands and file operations like mkdir and mv.
Sanitization: There is no evidence of sanitization or validation of the instructions provided in the external JSON before the agent is told to follow them.
[COMMAND_EXECUTION]: The skill constructs shell commands by interpolating variables that are either user-provided or sourced from external tool outputs.
Evidence: Variables like <name>, <changeRoot>, and <target-name> are placed inside quotes in commands such as openspec status --change "<name>" and mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>". If these variables contain shell metacharacters that escape the quotes, it could lead to arbitrary command execution within the agent's environment.

openspec-archive-change