The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various commands using the openspec CLI tool via Bash. These commands include new change, status, instructions, and schemas. The agent uses user-provided strings (change names, store IDs) to parameterize these commands. The execution risk is mitigated by the allowed-tools frontmatter, which restricts shell access to the openspec:* namespace.
[INDIRECT_PROMPT_INJECTION]: The skill reads existing artifacts (Markdown files) from the local file system and uses their content as context for generating new files or determining workflow steps. This creates a surface where malicious instructions embedded in these files could influence the agent's output or command parameters.
Ingestion points: The agent is instructed to re-read completed dependency files from disk (e.g., proposal.md, specs/spec.md) during the creation of subsequent artifacts.
Boundary markers: The skill includes a "Planning boundary" section that explicitly restricts the agent to creating planning artifacts only and forbids editing project code.
Capability inventory: The agent possesses file-writing capabilities and can execute scoped shell commands via the openspec CLI.
Sanitization: The skill does not define specific validation or escaping mechanisms for the content read from external artifacts before it is processed.

openspec-propose