The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes project-specific files and CLI outputs that could contain malicious instructions.
Ingestion points: The skill reads project context and background from openspec/config.yaml (or config.yml). It also executes openspec instructions and is explicitly told to "follow" the returned template and instruction fields when creating artifacts.
Boundary markers: Absent. The agent is directed to ground its thinking in these files and treat the instructions as constraints without clear delimiters between system and untrusted project content.
Capability inventory: The skill has capabilities to read arbitrary files in the codebase, search code, and create or modify OpenSpec artifacts (proposals, designs, specs) using the openspec CLI.
Sanitization: None. The skill adopts instructions from the project data as constraints for its operation without validation.
[COMMAND_EXECUTION]: The skill makes extensive use of the openspec CLI tool to manage project state and discover context, which is the primary intended behavior and is restricted by the platform's tool policy.
Evidence: Usage of subcommands such as openspec list, openspec status, openspec new change, and openspec store list.

openspec-explore