The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain instructions intended to influence the agent's behavior.
Ingestion points: The agent reads project-level context from <root.path>/openspec/config.yaml (or .yml) and existing artifact files identified through the openspec status command (SKILL.md).
Boundary markers: Absent. The skill does not instruct the agent to use specific delimiters or ignore embedded instructions when reading these external files (SKILL.md).
Capability inventory: The skill is authorized to use the openspec CLI via Bash(openspec:*), which includes commands for creating new project changes, instructions, and artifacts (Frontmatter, SKILL.md).
Sanitization: Absent. There are no instructions for sanitizing or validating the content of the configuration or artifact files before they are incorporated into the agent's context (SKILL.md).
[COMMAND_EXECUTION]: The skill invokes the openspec CLI to manage and investigate project state.
Evidence: Multiple commands including openspec list, openspec status, and openspec new change are used throughout the exploration workflow. The allowed-tools field in the frontmatter explicitly limits these executions to the openspec namespace, which provides a security boundary against arbitrary shell execution.

openspec-explore