The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates user-provided data into a shell command via openspec new change "<name>". While the agent is instructed to derive a kebab-case name from the user's description, which acts as a mitigation, the use of user-controlled input in shell commands remains a potential injection surface if the formatting instruction is not strictly followed.
[INDIRECT_PROMPT_INJECTION]: The skill processes JSON output from the openspec instructions command, which contains 'rules' and 'instructions' that the agent is directed to follow. This creates a surface for indirect prompt injection if the CLI tool or its underlying data source provides adversarial instructions.
Ingestion points: The agent reads data from openspec instructions <artifact-id> --change "<name>" --json as described in Step 4a of SKILL.md.
Boundary markers: None. There are no explicit delimiters or safety instructions used to isolate external rules from the agent's core operating instructions.
Capability inventory: The skill has permissions to execute shell commands (scoped to the openspec CLI) and write files to the local file system.
Sanitization: The skill instructions do not specify a validation or sanitization process for the instructions retrieved from the tool output before the agent acts upon them.

openspec-propose