The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external project data, creating a surface where malicious instructions could be embedded in files to influence the agent's behavior.
Ingestion points: The agent is instructed to read a context field from openspec/config.yaml (up to 51,200 bytes) and various existing markdown artifacts (proposal.md, spec.md, etc.) to guide the planning process.
Boundary markers: The instructions include explicit guardrails, such as a "planning boundary" prohibiting code edits and a directive to avoid copying project context or rules directly into generated artifacts.
Capability inventory: The skill uses the openspec CLI tool via Bash(openspec:*) to create and manage planning changes and artifacts.
Sanitization: Although the skill directs the agent to sanitize user-provided change names into kebab-case (minimizing command injection risks), it does not prescribe sanitization for the project-provided config or file contents before they are processed by the LLM.

openspec-propose