The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read, search, and investigate the user's codebase to facilitate discussion and architectural exploration. This process ingests untrusted data from the local file system into the agent's context, which could contain malicious instructions.
Ingestion points: The skill explicitly instructs the agent to "read files, search code, and investigate the codebase" and specifically to "Read existing files from artifactPaths..existingOutputPaths" identified via CLI status commands.
Boundary markers: The skill attempts to mitigate risks by setting a strong behavioral stance: "IMPORTANT: Explore mode is for thinking, not implementing. You... must NEVER write code or implement features."
Capability inventory: The agent is authorized to use the openspec CLI tool and has the capability to write to local markdown files (specs, designs, proposals, tasks).
Sanitization: No explicit sanitization or filtering of codebase content is mentioned before it is processed by the agent.
[COMMAND_EXECUTION]: The skill requires the use of a local openspec CLI tool to manage design artifacts and workspace state.
Evidence: The skill utilizes commands such as openspec list --json, openspec status --change "<name>" --json, and openspec store list --json to retrieve workspace context.
Scope: Execution is scoped to the openspec binary as defined in the allowed-tools: Bash(openspec:*) frontmatter, which restricts command execution to this specific toolset.

openspec-explore