The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read local codebase files and project-specific configuration (e.g., openspec/config.yaml) to provide grounded thinking. This creates an attack surface where instructions embedded in project files could influence the agent.
Ingestion points: Codebase files, config.yaml, and JSON output from the openspec CLI.
Boundary markers: The skill does not define explicit delimiters for content read from files.
Capability inventory: The skill can execute openspec CLI commands and read local files.
Sanitization: There is no evidence of sanitization for data ingested from the project environment.
[COMMAND_EXECUTION]: The skill executes openspec CLI commands through a bash interface, passing user-supplied input such as change names and store IDs as arguments (e.g., openspec new change "<name>"). While the instructions specify quoting the arguments, the security of this interaction depends on the underlying environment's handling of shell metacharacters.

openspec-explore