The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes instructions and rules from project-local configuration files via the openspec CLI, which can be manipulated by malicious repositories to influence agent behavior.
Ingestion points: Artifact instructions and project context are fetched from the openspec instructions and openspec status commands in SKILL.md.
Boundary markers: Absent. The agent is directed to treat the instruction field as authoritative guidance.
Capability inventory: File system write access to resolvedOutputPath and execution of openspec CLI commands.
Sanitization: Absent. The skill does not validate or sanitize the content of the instructions or the output paths provided by the CLI.
[COMMAND_EXECUTION]: The skill contains a logic flow that executes commands specified within data processed at runtime, which could be exploited if that data is compromised.
Evidence: SKILL.md states: "If the instruction field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself."
[DYNAMIC_EXECUTION]: The skill dynamically determines its operations, including which commands to run and where to write files, based on JSON output from the openspec tool.
Evidence: The skill uses variables like resolvedOutputPath and instruction from CLI-generated JSON to drive its actions.

openspec-propose