The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructs the agent to dynamically execute commands or other skills if the instruction field returned by the openspec instructions command delegates the creation of an artifact. This creates a mechanism where the behavior of the agent is controlled by the output of an external CLI tool, rather than static instructions.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes data from external sources without explicit sanitization.
Ingestion points: Instructions and project background are ingested via the openspec instructions command (JSON fields: context, rules, instruction). The agent also reads existing project artifact files from the disk.
Boundary markers: The skill implements a 'Planning boundary' to restrict implementation and code edits. It also provides instructions to treat context and rules as internal constraints rather than content to be output.
Capability inventory: The skill can execute shell commands via the openspec CLI and write new files to the system.
Sanitization: No validation or sanitization of the input from the CLI tool or project files is specified.
[COMMAND_EXECUTION]: The skill relies heavily on executing shell commands through the openspec CLI to manage changes, check status, and retrieve instructions. While these tools are explicitly allowed in the frontmatter, they allow the agent to interact with the local file system and project structure.
[METADATA_POISONING]: The skill's frontmatter lists the author as 'openspec', which does not match the provided author context of 'full-stack-skills'. This inconsistency in metadata could be misleading regarding the skill's provenance.

openspec-propose