The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various shell commands through the openspec CLI tool, such as openspec list, openspec status, and openspec instructions apply. These commands are used to manage the state of a task-driven workflow.
[INDIRECT_PROMPT_INJECTION]: The skill reads and processes the contents of external project files (defined as contextFiles) to implement code changes. This ingestion of untrusted data represents an attack surface for indirect prompt injection.
Ingestion points: File paths provided by the openspec instructions apply command's contextFiles field, which are subsequently read by the agent.
Boundary markers: The instructions do not specify any delimiters or safety headers to distinguish between project data and agent instructions within these files.
Capability inventory: The agent has the capability to perform arbitrary code changes and modify task tracking files.
Sanitization: There is no evidence of content sanitization or validation performed on the ingested file data before it is used to guide implementation.

openspec-apply-change