The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to interpolate user-provided values, such as change names and store IDs, directly into Bash command strings (e.g., openspec status --change "<name>" --json --store "<id>"). This pattern creates a potential surface for command or argument injection if the platform or the underlying CLI does not perform strict sanitization of these inputs.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted data from the local environment, including project configuration files, codebase content, and the output of CLI commands.
Ingestion points: The agent reads openspec/config.yaml, searches the codebase for patterns, and processes JSON output from the openspec status and openspec instructions commands.
Boundary markers: The instructions lack clear boundary markers or isolation protocols to prevent instructions embedded within the codebase or configuration files from influencing the agent's logic.
Capability inventory: The skill possesses the capability to execute openspec CLI commands via Bash, read arbitrary files within the codebase, and write OpenSpec artifacts (markdown files) to the local file system.
Sanitization: There are no explicit instructions for the agent to sanitize, escape, or validate the content retrieved from external files or command outputs before incorporating them into its 'thinking' or subsequent actions.

openspec-explore