The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the openspec CLI for state management and metadata retrieval. The execution environment is restricted via the allowed-tools configuration to the openspec command namespace.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface where untrusted data could influence agent behavior.
Ingestion points: User-provided descriptions, JSON output from openspec CLI commands, and existing artifact files (dependencies) read from the filesystem.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present when processing external content.
Capability inventory: Access to Bash (scoped to openspec:*) and the ability to write files to the local directory.
Sanitization: No explicit sanitization or content validation is performed on the data ingested from dependencies or CLI outputs before it is used for artifact creation.
[DYNAMIC_EXECUTION]: The skill contains logic to execute commands or skills dynamically if specified in the instruction field of the CLI's output. Although this is a functional requirement for flexible workflows, it introduces a path for dynamic command invocation, which is partially mitigated by the platform-level tool restrictions.

openspec-propose