The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using the openspec and codegraph CLI tools. Arguments for these commands, such as change names (<name>) and extracted keywords (<key terms>), are derived from user input or external artifact content. While the instructions recommend wrapping these in double quotes, there is a risk of command injection if the source data contains shell-active characters (e.g., backticks or subshell expansions) that are not properly sanitized.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes data from external files (proposals, designs, and task lists). This untrusted content is used to influence the agent's subsequent actions, including the generation of search terms for the codegraph explore command.
Ingestion points: Task descriptions and artifact files (proposal, design, tasks) listed in the contextFiles output of the openspec CLI in SKILL.md.
Boundary markers: None; the skill does not use specific delimiters or instructions to ignore potential commands within the ingested data.
Capability inventory: The skill has the ability to execute shell commands (openspec, codegraph) and modify the local file system (updating task checkboxes and code implementation).
Sanitization: There are no explicit instructions to sanitize or validate the content extracted from artifacts before using it in tool invocations.

openspec-apply-change