The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and interpret data from multiple external files (proposal.md, tasks.md, spec.md, design.md) within the openspec/changes/ directory. These files represent untrusted ingestion points where an attacker could embed malicious instructions aimed at influencing the agent's behavior during the conversion process.
Ingestion points: openspec/changes/<change>/proposal.md, openspec/changes/<change>/tasks.md, openspec/changes/<change>/specs/*/spec.md.
Boundary markers: The instructions do not define explicit delimiters or instructions for the agent to ignore embedded commands within the planning artifacts.
Capability inventory: The agent has the capability to execute shell commands (bd create, bd dep add, openspec show).
Sanitization: There is no explicit sanitization or validation of the content extracted from these files before it is used to generate tasks or summary reports.
[COMMAND_EXECUTION]: The skill uses shell templates to create issues in the Beads system. In templates/issue-creation.md, values parsed from the external files are interpolated directly into shell commands, such as bd create "[<change>] <category>: <task-description>". If the task descriptions or category names in the source files contain unescaped shell characters (specifically double quotes), it could result in command injection on the host system.

openspec-to-beads