The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill interacts with untrusted project data that could contain malicious instructions.
Ingestion points: The instructions in SKILL.md direct the agent to read arbitrary codebase files and search code, as well as read project context from openspec/config.yaml.
Boundary markers: No delimiters or instructions are used to distinguish read content from agent instructions.
Capability inventory: SKILL.md grants access to Bash(openspec:*) commands and file-writing capabilities to record exploration results.
Sanitization: No sanitization is performed on codebase data before processing.
[COMMAND_EXECUTION]: The skill executes openspec CLI commands via the Bash tool to manage project metadata and artifacts. Evidence includes calls to openspec list --json, openspec status, and openspec new change as described in SKILL.md. These commands are scoped to the openspec namespace, reducing the risk of arbitrary command injection.

openspec-explore