The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash(openspec:*) tool to interact with the local operating system. It executes various subcommands such as openspec new change, openspec status, openspec instructions, and openspec context to manage project state and artifacts.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core workflow of processing external data.
Ingestion points: The agent reads user-provided descriptions of build requests, JSON output from the openspec CLI (specifically the instruction and context fields), and existing artifact files from the disk (dependency artifacts).
Boundary markers: There are no explicit delimiters or instructions provided in the skill to treat external file content as untrusted data or to ignore embedded instructions within those files.
Capability inventory: The agent has the ability to read and write files to the local file system and execute shell commands via the openspec CLI.
Sanitization: The skill does not mention or implement any sanitization, filtering, or validation for the content read from files or user input before using it to generate new artifacts or commands.
[DYNAMIC_EXECUTION]: In Step 5a, the skill contains logic to dynamically execute commands based on external data: 'If the instruction field delegates creation to a specific skill or command, invoke it to produce the artifact'. This allows the content of the openspec instructions command (which comes from the project's .openspec.yaml or CLI configuration) to dictate which commands the agent runs.

openspec-propose