The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads the contents of tasks.md and the output of the openspec CLI to determine project status.
Ingestion points: The skill reads tasks.md from the local filesystem and parses JSON output from openspec status and openspec list.
Boundary markers: There are no explicit delimiters or boundary instructions provided to the agent to treat the contents of these files as untrusted data.
Capability inventory: The skill has the capability to execute shell commands (mkdir, mv) and invoke other skills or sub-agents via the Task tool.
Sanitization: No sanitization or validation logic is defined for the content read from the filesystem or CLI tools before it is processed by the agent.
[COMMAND_EXECUTION]: The skill dynamically generates shell commands using variables retrieved from tool outputs.
Evidence: The skill uses variables like planningHome.changesDir, changeRoot, and name to construct commands: mkdir -p "<planningHome.changesDir>/archive" and mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>".
Risk: If these variables (derived from local project configuration or file names) contain shell control characters, they could lead to command injection, although the risk is mitigated by the variables originating from the specialized openspec tool.

openspec-archive-change