The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests content from previously created artifact files (such as proposal.md or design.md) to serve as context for generating new artifacts in the workflow. A malicious file could potentially influence the agent's behavior during subsequent steps.
Ingestion points: Completed dependency files are read from disk during the artifact creation loop in Step 5a.
Boundary markers: No specific delimiters or safety instructions are provided to the agent to treat the ingested file content as untrusted data.
Capability inventory: The agent can execute openspec CLI commands and write files to the local project directory.
Sanitization: The skill does not perform sanitization on the content of the dependency files before they are read into context.
[DYNAMIC_EXECUTION]: The workflow allows the openspec CLI to delegate the creation of specific artifacts to other commands or skills via the 'instruction' field returned in JSON responses. This allows for dynamic execution paths determined by tool output at runtime.
[COMMAND_EXECUTION]: The skill executes various CLI commands using the openspec tool. While it instructs the agent to convert user-provided names into kebab-case, it relies on the agent to correctly perform this sanitization to prevent potential command injection if the name contains shell metacharacters.

openspec-propose