The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and acts upon instructions provided in external data sources.
Ingestion points: The skill parses task lists from openspec instructions apply and reads multiple project files identified in the contextFiles metadata.
Boundary markers: Absent. There are no delimiters or specific instructions to treat external data as non-executable text.
Capability inventory: The agent has the capability to execute openspec CLI commands and perform file system modifications (writes/edits).
Sanitization: Absent. The skill directs the agent to "Implement tasks" directly from the provided descriptions, which could contain malicious directives.
[COMMAND_EXECUTION]: The skill relies on shell command execution via the openspec CLI to manage workflows.
Evidence: Frequent use of openspec status, openspec list, and openspec instructions with arguments provided via the user or previous command outputs.
Mitigation: The skill includes a "Workspace guard" mechanism that checks actionContext.mode and allowedEditRoots to prevent unauthorized file edits in restricted environments.

openspec-apply-change