The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local project environment, including openspec/config.yaml, specification files (spec.md), and design artifacts. It also processes instruction and template fields returned by the openspec instructions CLI command. These sources could contain malicious prompts designed to influence the agent's behavior during artifact generation.
Ingestion points: openspec/config.yaml, specs/*.md, design.md, proposal.md, tasks.md, and output from openspec instructions.
Boundary markers: The skill instructs the agent to treat these as constraints and not to copy them into conversation, but lacks strict technical delimiters for all ingested data.
Capability inventory: Execution of openspec CLI commands via Bash to read/write project metadata and artifacts.
Sanitization: No specific sanitization or validation of the content within specifications or CLI instructions is mentioned.
[DYNAMIC_EXECUTION]: The skill implements dynamic execution logic where the agent's actions are directed by the output of the openspec instructions command. The prompt explicitly states: "If the instruction delegates creation to a specific skill or command, invoke it". This allows external data to dynamically determine which tools or workflows the agent executes at runtime.
[COMMAND_EXECUTION]: The skill relies on executing openspec CLI commands through a Bash interface. While the allowed-tools frontmatter field restricts execution to the openspec binary, the agent is instructed to run multiple read and write commands (e.g., openspec new change, openspec status, openspec archive) based on project state and user input.

openspec-explore