The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute openspec CLI commands. These commands are used to manage workflow states, retrieve task-specific instructions, and interact with repository stores. The access is limited to the openspec namespace, which follows the principle of least privilege.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data returned by the CLI, specifically the context and operationGuidance fields. Since these fields originate from files within the project repository being worked on, they represent a surface for indirect prompt injection where a malicious file could attempt to influence the agent's behavior.
Ingestion points: JSON output from openspec status and openspec instructions processed in SKILL.md.
Boundary markers: The skill contains explicit instructions to treat this external data as advisory additive guidance and to keep it strictly separate from the core CLI-controlled logic.
Capability inventory: The agent has capabilities to execute openspec commands and perform file read/write operations within the project root to update task statuses.
Sanitization: The prompt provides mandatory logic for the agent to report conflicts between project-level context and built-in instructions, ensuring the agent prioritizes controlling workflow values over external guidance.

openspec-apply-change