The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads instructions, context, and rules from external sources, specifically the output of shell commands (openspec instructions) and existing project files (e.g., proposal.md, specs/spec.md). If these files or the tool output contain malicious instructions, the agent may follow them as they are treated as project constraints.
Ingestion points: Relative artifact paths on disk and the JSON output from openspec instructions subcommands.
Boundary markers: The skill provides textual instructions to use fields as constraints and avoid copying them, but lacks robust delimiters to wrap the untrusted content.
Capability inventory: The agent can execute openspec subcommands via the Bash tool and write files to the project directory.
Sanitization: There is no explicit sanitization or validation of the text content ingested from these external files or command outputs.
[COMMAND_EXECUTION]: The skill builds shell commands for the openspec CLI by interpolating user-provided or agent-derived variables like <name>, <schema-name>, and <store-id>. While the agent is instructed to normalize these into kebab-case, raw user input could theoretically be used for command injection, though the impact is restricted by the allowed-tools filter which only permits openspec:* commands.
[DYNAMIC_EXECUTION]: The workflow allows the instruction field in the openspec JSON response to dynamically delegate artifact creation to a specific skill or command. This pattern means the agent may execute different subcommands based on data provided at runtime from the project environment.

openspec-propose