The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local repository files and tool outputs which are then used to drive agent logic and subagent prompts.
Ingestion points: Reads tasks.md, spec.md, and the JSON output from openspec status --json (SKILL.md, Steps 2, 3, and 4).
Boundary markers: No delimiters or "ignore embedded instructions" warnings are used when the agent processes the content of these files.
Capability inventory: The skill has the ability to execute shell commands (mkdir, mv) and invoke subagents with general-purpose prompts.
Sanitization: The skill does not describe any validation or sanitization steps for the content read from the tasks.md or delta specs before they are used in decision-making or passed to other tools.
[COMMAND_EXECUTION]: The skill dynamically constructs shell commands using variables that may be influenced by external configuration or file content.
Evidence: In Step 5, the skill executes mkdir -p "<planningHome.changesDir>/archive" and mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>". If the JSON output from the openspec CLI or the user-provided name contains shell metacharacters (e.g., $(), ` `, ;), it could lead to command injection depending on how the agent's tool execution environment handles string interpolation.

openspec-archive-change