The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by interpolating variables like <name> and <artifact-id> (e.g., openspec status --change "<name>" --json). If these variables, which can originate from user input or conversation context, contain shell metacharacters, it could lead to command injection depending on how the execution environment handles the quoted strings.
[INDIRECT_PROMPT_INJECTION]: The skill processes project background, rules, and guidance provided by the openspec CLI (fields context, rules, and instruction). Since this data is derived from external files managed by the CLI, malicious content within those files could potentially influence the agent's behavior during artifact creation.
Ingestion points: Data returned by openspec instructions and dependency files read from resolvedOutputPath (described in SKILL.md).
Boundary markers: The skill contains instructions for the agent to treat this data as constraints rather than content, but does not use explicit delimiters to isolate the untrusted input.
Capability inventory: File system read/write operations and execution of the openspec CLI tool.
Sanitization: No explicit sanitization or validation of the content retrieved from the CLI or dependency files is described.

openspec-continue-change