The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes and executes instructions provided by project-level configuration files via the openspec instructions command. It explicitly treats the instruction field as 'authoritative guidance', creating a surface for indirect prompt injection if the project environment or configuration is compromised.
Ingestion points: Data returned by openspec instructions <artifact-id> --change "<name>" --json (Step 5a).
Boundary markers: No boundary markers or 'ignore embedded instructions' warnings are present; the skill is explicitly told to follow these instructions as the primary source of truth.
Capability inventory: File writing at resolved paths and shell command execution using the Bash(openspec:*) tool.
Sanitization: No sanitization or validation of the ingested instruction content is performed before the agent acts upon it.- [COMMAND_EXECUTION]: The skill constructs shell commands using user-supplied inputs and external project data. While the allowed-tools configuration restricts execution to the openspec binary, the skill includes a specific workflow to delegate creation to commands found within the (potentially untrusted) instruction metadata field.
Evidence: The instructions state: 'If the instruction field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself'.

openspec-propose