The Agent Skills Directory

[SAFE]: The skill operates within a highly restricted execution environment. The allowed-tools configuration limits shell access exclusively to the openspec CLI binary, which prevents the agent from executing arbitrary system commands, downloading external scripts, or utilizing common network exfiltration tools like curl or wget.
[SAFE]: The workflow incorporates robust human-in-the-loop controls. The instructions explicitly require the agent to present proposed revisions and the rationale behind them to the user, waiting for explicit confirmation before any write operations are performed on the file system.
[SAFE]: The skill maintains strict functional boundaries to prevent unintended side effects. It contains multiple directives (in the description, steps, and guardrails) to never edit implementation code, focusing only on planning artifacts defined within the OpenSpec schema.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local environment via openspec CLI outputs (JSON) and reads content from artifact files on disk. While this represents a potential surface for indirect prompt injection from compromised project files, the risk is effectively mitigated by the skill's reliance on structured JSON parsing and the mandatory user approval step for all output generated from that data.

openspec-update-change