The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using the openspec tool, such as openspec list, openspec status, and openspec instructions. It accepts a change name from the user and inserts it into command strings (e.g., openspec status --change "<name>" --json). While the input is enclosed in quotes, this pattern presents a potential command injection surface if the input contains shell metacharacters designed to escape the quotation marks.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local workspace to generate new content.
Ingestion points: The agent reads existing Markdown artifacts, dependency files, and glossary files (openspec/GLOSSARY.md and openspec/changes/<name>/GLOSSARY.md) to gather context for writing new artifacts.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore potentially malicious instructions embedded within the files it reads.
Capability inventory: The skill possesses the capability to write files to the local file system (at paths specified by the openspec CLI output) and to execute further openspec commands.
Sanitization: The skill does not implement sanitization or validation of the content read from the workspace before using it to generate new artifacts.

openspec-continue-change