The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands such as mkdir -p and mv to manage local directories and files. It interpolates a <name> variable into these commands, which is a standard pattern for developer tooling but represents a potential attack surface for command injection if the input name is maliciously crafted.
[SAFE]: The skill's operations are confined to the local file system and are directly related to its stated purpose of archiving project changes. No evidence of data exfiltration, unauthorized network communication, or safety bypass instructions was found during the analysis.
[SAFE]: The skill reads external content from tasks.md and processes JSON output from the openspec command to evaluate completion status. While this introduces an ingestion surface for untrusted data, the skill includes explicit guardrails requiring user confirmation before proceeding with any action when warnings are present.

openspec-archive-change