The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface.
Ingestion points: Content is read from local files identified in contextFiles (such as tasks.md, specs.md, and design.md) and from the broader codebase during keyword searches.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when interpolating the contents of these files into the agent's context.
Capability inventory: The skill has access to the Bash(openspec:*) toolset and standard file system reading capabilities.
Sanitization: There is no mention of sanitizing or escaping the text extracted from specifications or code before it is processed by the agent.
[COMMAND_EXECUTION]: The skill uses the openspec CLI to perform several operations. It constructs shell commands by interpolating variables like <name> into strings (e.g., openspec status --change "<name>" --json). While the execution environment limits tool access to the openspec binary, this pattern creates a surface for potential command injection if the change names are sourced from untrusted data and not properly sanitized by the platform.

openspec-verify-change