The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes JSON data from the openspec CLI and reads contents of previously created artifact files to generate new ones. This structure is susceptible to indirect prompt injection where malicious instructions could be embedded in the CLI output or dependency files.
Ingestion points: Data is ingested from openspec status --json and openspec instructions --json commands, and by reading completed dependency artifacts in SKILL.md.
Boundary markers: There are no explicit delimiters or boundary markers used to separate the external data from the skill's instructions in SKILL.md.
Capability inventory: The skill utilizes bash for CLI interaction, TodoWrite for progress tracking, and file-writing capabilities to create artifacts as described in SKILL.md.
Sanitization: No sanitization, escaping, or schema validation is performed on the data ingested from the CLI or files.
[COMMAND_EXECUTION]: The skill constructs and executes shell commands (openspec new change "<name>") using a name derived from user input. While the skill instructs the agent to convert input to kebab-case, this pattern poses a potential command injection risk if the agent fails to properly sanitize the user-provided description before passing it to the shell.

openspec-propose