The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external specification files and task descriptions, which presents an indirect prompt injection surface where malicious content could attempt to override agent behavior. \n
Ingestion points: Specification files located in openspec/specs/ and specs/*.md, and SRD tasks in srd-espanol/gap-audit.md. \n
Boundary markers: Utilizes the 'Bilingual Format' (Human Layer + Agent Layer) as a structural separator, though this does not provide cryptographic isolation. \n
Capability inventory: The skill is capable of creating Linear issues, sending Slack notifications, writing to the file system, and executing shell commands via sub-agents. \n
Sanitization: No explicit sanitization or validation logic is documented for the contents of the specification files before they are processed by the agent. \n- [COMMAND_EXECUTION]: The skill generates and facilitates the execution of shell commands (e.g., openspec, git, task-master) to manage the implementation lifecycle. While these are necessary for the skill's functionality, they represent a capability that could be leveraged if an input specification is malicious. \n- [EXTERNAL_DOWNLOADS]: The skill references and integrates with external Model Context Protocol (MCP) servers for Linear, Slack, and TaskMaster. These are well-known technology services, and their use in this context is documented neutrally as part of the skill's intended project management and notification features.

spec-recommend