The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a command-line interface tool named openspec to perform its tasks. It executes commands such as openspec --version for environment checking, openspec list to inventory existing specifications, and openspec validate to ensure the integrity of generated files. These operations are core to the skill's documented purpose of managing the OpenSpec workflow.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes source code, implementation details, and test suites to derive business requirements, which introduces an indirect prompt injection attack surface.
Ingestion points: The agent and its subagents ingest untrusted data from implementation files (src/), test files, and documentation (README, AGENTS.md, docs/) to identify candidate behaviors.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from obeying instructions that might be embedded within code comments or documentation files being analyzed.
Capability inventory: The skill possesses the capability to execute shell commands (via the openspec CLI), write to the file system (specifically within the openspec/ directory), and dispatch subagents to perform exploration tasks.
Sanitization: The instructions do not specify any sanitization or filtering of the codebase content before it is processed by the agent's logic to generate specifications.

codely-openspec-spec-create-from-code