The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a dynamic resolution algorithm for sub-agent definitions, prioritizing project-local files (.claude/skills/ and openspec/config.yaml) over global configurations. In an untrusted project environment, an attacker could supply malicious SKILL.md files that the orchestrator will resolve and load. The orchestrator explicitly instructs the sub-agents to follow these external instructions exactly, allowing for full hijacking of the sub-agent's logic.
[PROMPT_INJECTION]: The 'Context extraction' logic creates a surface for indirect prompt injection by parsing user input and writing the results into a shared artifact.
Ingestion points: The $ARGUMENTS variable containing the user's description (SKILL.md).
Boundary markers: None are applied to the extracted content when writing to the proposal.md skeleton (SKILL.md).
Capability inventory: Subsequent sub-agents (propose, spec, design, tasks) have broad capabilities to read and modify project files, specifications, and design documents (SKILL.md).
Sanitization: No sanitization, escaping, or validation is performed on the extracted strings before they are interpolated into the proposal file (SKILL.md).

sdd-ff