The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using variables derived from the local environment without explicit sanitization or escaping.
Evidence: In Step 8, the skill uses the <name> variable (from openspec list) directly in a shell command: mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>.
Potential Impact: If a directory name or change title contains shell metacharacters (e.g., semicolons, backticks, or command substitutions), it could lead to unauthorized command execution when the archive step is performed.
[INDIRECT_PROMPT_INJECTION]: The skill reads and processes external files to make decisions about conflict resolution, creating a surface for indirect prompt injection.
Ingestion points: Files located at openspec/changes/<name>/tasks.md and the openspec/changes/<name>/specs/ directory, as well as JSON output from the openspec list command.
Boundary markers: Absent; the skill does not define specific delimiters or instructions to ignore embedded commands within the processed data.
Capability inventory: The agent has the ability to execute shell commands (mkdir, mv), search the entire codebase, and perform complex logic to resolve capability conflicts.
Sanitization: Absent; the data read from the filesystem is used to drive the agent's "agentic resolution" logic in Step 5 without filtering or validation, allowing malicious instructions in a tasks.md or delta spec to potentially influence the agent's actions.

openspec-bulk-archive-change