The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash(openspec:*) tool to interact with the local file system and project state. It executes commands such as openspec status, openspec list, and openspec instructions to retrieve project metadata and workflow requirements. These commands are restricted by the allowed-tools metadata field.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external sources (CLI JSON responses and existing markdown files), which represents a vulnerability surface for indirect prompt injection.
Ingestion points: The agent reads data from the JSON output of the openspec CLI and the contents of previously completed artifact files (dependencies).
Boundary markers: The instructions lack explicit delimiters or specific 'ignore embedded instructions' prompts when handling data retrieved from the CLI or file system.
Capability inventory: The agent has capabilities to read files, write files to paths determined by CLI output (resolvedOutputPath), and execute specific shell commands.
Sanitization: No explicit sanitization, validation, or escaping of the ingested data is defined before the agent uses it to generate new content.
Note: The skill includes a 'Guardrails' section that specifically instructs the agent to treat retrieved context and rules as internal constraints rather than content to be copied, which serves as a basic logic-based mitigation against some forms of instruction leakage.

openspec-continue-change