The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes project data and codebase content which could theoretically contain malicious instructions.
Ingestion points: The skill reads project configuration files (openspec/config.yaml), existing markdown artifacts, and general codebase files during investigation.
Boundary markers: No specific delimiters or boundary markers are defined for the ingestion of these files.
Capability inventory: The skill can execute openspec CLI commands and write to specific artifact paths (proposals, designs, specs).
Sanitization: No explicit sanitization or filtering is performed on the ingested content.
Context: This behavior is central to the skill's purpose as a "thinking partner." The risk is mitigated by a strong internal guardrail that explicitly forbids the agent from writing application code or implementing features.
[COMMAND_EXECUTION]: The skill utilizes the openspec CLI tool. This execution is restricted by the YAML frontmatter's allowed-tools: Bash(openspec:*) field, which prevents the agent from running arbitrary or unauthorized shell commands outside of the specific vendor toolset.

openspec-explore