The Agent Skills Directory

[SAFE]: The skill is configured with appropriate security restrictions via the allowed-tools field, limiting shell command execution specifically to the openspec CLI. No unauthorized network operations, persistence mechanisms, or obfuscation techniques were identified.
[INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface for indirect prompt injection through the ingestion of external file content and CLI metadata.
Ingestion points: The skill reads contextFiles (concrete repository files) and processes context and operationGuidance fields from openspec CLI outputs as described in SKILL.md.
Boundary markers: Explicit instructions are provided to the agent to treat external guidance as optional, prioritize built-in workflow logic, and report any conflicts between the CLI state and external context.
Capability inventory: The agent can execute openspec CLI commands, read local files, and modify task status within markdown documents.
Sanitization: The instructions include a specific prohibition against copying runtime context or advisory guidance into implementation files or planning artifacts, preventing the persistence of potentially untrusted data.

openspec-apply-change