The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local project files (specifications, tasks, design documents, and source code) and incorporates this content into its evaluation logic. This creates a surface where malicious instructions hidden in a spec file could influence the agent's verification behavior.
Ingestion points: Project artifacts (specs, tasks, design) identified via openspec instructions apply and the broader codebase via keyword search.
Boundary markers: None identified; the instructions do not define delimiters or specific warnings to the agent to disregard instructions embedded within the analyzed data files.
Capability inventory: The skill uses the Bash(openspec:*) tool to read files and execute CLI commands.
Sanitization: There is no evidence of sanitization or escaping of the ingested file content before it is parsed for requirements or scenarios.
[COMMAND_EXECUTION]: The skill constructs shell commands by interpolating variables derived from conversation context or user input, specifically in the pattern openspec status --change "<name>" --json. This represents a potential surface for command injection if the <name> variable is not properly sanitized or quoted by the execution environment before being passed to the shell.

openspec-verify-change