The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from user-controlled design.md files (specifically the specs_touched and decisions fields) and interpolates this content into global project indices such as openspec/specs/INDEX.md and openspec/changes/archive/INDEX.md. While the skill utilizes YAML frontmatter as a boundary, there are no explicit sanitization or escaping steps described for the content before it is written to the index files or reported back to the user.
Ingestion points: openspec/changes/<slug>/design.md (frontmatter).
Boundary markers: Uses YAML frontmatter delimiters (---) and structured list formats.
Capability inventory: File writing (openspec/specs/INDEX.md, openspec/changes/archive/INDEX.md), subprocess execution (grep, ls, cat), and subagent spawning.
Sanitization: No explicit sanitization or filtering logic is provided for decision choice fragments or purpose summaries before inclusion in markdown tables.
[COMMAND_EXECUTION]: The skill logic instructs the agent to perform targeted edits on INDEX.md files using the grep command. The search patterns for these commands are constructed using capability names sourced directly from the specs_touched list in design.md. Without rigorous validation of these capability names, this pattern presents a surface for command injection if a malicious user provides a capability name containing shell metacharacters.
Evidence: Step 25 in SKILL.md instructs the agent to "grep for the line whose first cell exactly matches the capability name" and then replace that line. If the capability name is sourced from an untrusted design.md file, it could be crafted to execute arbitrary commands.

accelint-qrspi-archive