The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data that could contain malicious instructions designed to influence agent behavior.
Ingestion points: User-provided change names/descriptions (Step 1) and JSON data retrieved via openspec instructions (Step 5a), specifically the instruction, context, rules, and template fields.
Boundary markers: The skill contains a 'Planning boundary' section that explicitly instructs the agent to stop after generating planning artifacts and not to modify project code or start implementation.
Capability inventory: The agent is authorized to execute openspec CLI commands via Bash and write files to the local filesystem (Step 3, Step 5a).
Sanitization: The skill does not describe explicit sanitization or validation of the input strings before they are used in CLI commands or output as files.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using variables derived from user input.
Evidence: The agent uses user-provided names to execute openspec new change "<name>" and openspec status --change "<name>" in SKILL.md (Step 3 and Step 4).
[DYNAMIC_EXECUTION]: The workflow allows the execution logic to be dynamically changed by external tool output.
Evidence: Step 5a in SKILL.md instructs the agent to "invoke it [a specific skill or command] to produce the artifact" if the instruction field from the CLI tool delegates creation, rather than following a static file-writing procedure.

openspec-propose