The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's instructions require the agent to invoke specific skills or commands if the instruction field in the JSON output from openspec instructions delegates the creation of an artifact. This creates a mechanism where the external CLI tool can dictate executable actions for the agent at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill processes multiple external data sources, including JSON from the openspec CLI and existing artifact files from the disk (dependencies). These sources provide an attack surface for indirect prompt injection where malicious content could override the agent's behavior.
Ingestion points: Output from openspec instructions and content of dependency files read from the disk in Step 5a.
Boundary markers: The skill contains internal reminders to use context and rules as constraints without copying them, but it lacks explicit technical delimiters to separate external data from system instructions.
Capability inventory: The agent can execute shell commands within the openspec namespace and write files to the local filesystem at resolvedOutputPath.
Sanitization: No sanitization or validation of the instruction, template, or dependency content is mentioned before it is processed or used to generate new files.
[COMMAND_EXECUTION]: The skill uses the openspec CLI for various operations. Commands are constructed using parameters like <name>, <store-id>, and <artifact-id> which originate from user input or external JSON. This presents a potential command argument injection surface if the parameters are not safely handled by the platform or the CLI tool itself.

openspec-propose