The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and interpret external data from project artifacts, creating a surface for indirect prompt injection attacks.
Ingestion points: tasks.md, design.md, and specification files located in the openspec/changes/<name>/specs/ directory.
Boundary markers: The skill does not define explicit boundary markers or instructions to ignore instructions embedded within the data files.
Capability inventory: The skill possesses the ability to execute the openspec CLI, perform codebase-wide keyword searches, and read local files.
Sanitization: There is no evidence of content sanitization or validation for the text extracted from the artifacts before it is used to guide the agent's verification process.
[COMMAND_EXECUTION]: The skill executes the openspec CLI with arguments provided by the user or inferred from context. While it instructs the agent to prompt the user to select from a list, there is a potential for command injection if a malicious change name is provided and the environment does not properly sanitize shell arguments.

openspec-verify-change