The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using the openspec CLI tool, incorporating a user-provided or inferred change name into the command line.
Evidence: openspec status --change "<name>" --json and openspec instructions apply --change "<name>" --json.
Risk: While the variable is wrapped in double quotes, it may still be susceptible to command injection if the input contains shell metacharacters such as backticks or subshell expansions (e.g., $(...)).
[INDIRECT_PROMPT_INJECTION]: The skill reads and implements instructions extracted from files within the local repository, creating a surface for indirect prompt injection.
Ingestion points: Reads files specified in the contextFiles output from the CLI, as well as openspec/GLOSSARY.md and local SPEC.md files.
Boundary markers: The instructions do not define any delimiters or warnings to ignore embedded instructions within these data sources.
Capability inventory: The skill has the ability to execute shell commands via the openspec CLI and perform arbitrary file writes/modifications during the task implementation loop.
Sanitization: No validation, escaping, or sanitization of the content retrieved from the repository files is mentioned before the agent processes and acts on that content.

openspec-apply-change