The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local shell commands using the openspec CLI. It takes user input (a description of a change) and instructs the AI to derive a kebab-case name to be used as a command-line argument: openspec new change "<name>". If the AI fails to correctly format this name or includes shell metacharacters, it could lead to command injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external sources, which creates a vulnerability surface.
Ingestion points: The skill reads JSON output from openspec instructions (containing context, rules, and instruction fields) and reads the content of previously completed artifact files to provide context for new ones.
Boundary markers: The instructions tell the AI that context and rules are constraints and should not be copied into the output, but there are no technical delimiters or "ignore instructions" wrappers for the ingested data.
Capability inventory: The skill has the ability to write files to the local file system (resolvedOutputPath) and execute CLI commands.
Sanitization: The skill does not define any sanitization or validation steps for the content retrieved from the CLI output or the dependency files before it is processed by the AI.

openspec-ff-change