The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project files such as proposal.md, tasks.md, and delta specs to drive its analysis and modification workflows. Ingestion points: Documentation and specification files within the openspec/ directory (e.g., references/review.md, references/reconcile.md). Boundary markers: The instructions do not define explicit delimiters or 'ignore embedded instructions' warnings when passing this data to specialist subagents. Capability inventory: The skill possesses significant capabilities including the ability to edit source code (references/review-work.md), write files, execute shell commands (git, grep, glob), and interact with external APIs (Linear). Sanitization: No evidence of sanitization, escaping, or validation of the ingested content was found. This creates a risk where malicious instructions embedded in a specification file could be executed by the specialist agents during automated patching or code-fix phases.
[COMMAND_EXECUTION]: The skill utilizes shell commands such as git log (references/commits.md) and grep/glob (references/review.md, references/explain.md) to inspect the repository history and structure. These commands are used for their intended primary purpose of repository auditing and are localized to the current project context.
[DYNAMIC_EXECUTION]: The skill employs a multi-agent architecture, spawning 'specialist subagents' to analyze different dimensions of the codebase and specifications (e.g., Specialist A/B/C/D in references/review.md). These agents receive untrusted file content as context, and their outputs are synthesized to drive further actions, including automated codebase modifications in the review-work and reconcile subcommands.

inspector