The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads existing artifact files from the disk to use as context for generating new ones. This creates a surface where malicious instructions embedded in project files could influence the agent's behavior.
Ingestion points: Reads files from paths specified in artifactPaths and dependencies (SKILL.md, Step 5a).
Boundary markers: Includes instructions to treat context and rules as constraints and not to copy them into output, but lacks explicit markers to ignore instructions inside read files.
Capability inventory: Can execute shell commands via the openspec CLI and write arbitrary files to the disk.
Sanitization: No explicit sanitization or filtering of the content read from dependency files is described.
[COMMAND_EXECUTION]: The skill relies on the openspec CLI tool to perform its operations, executing various subcommands like new change, status, and instructions.
[DYNAMIC_EXECUTION]: The skill includes logic to delegate artifact creation to other commands or skills if the instruction field from the CLI response specifies it (SKILL.md, Step 5a). This is a form of dynamic command assembly based on external tool output.

openspec-propose