The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute multiple subcommands of the openspec CLI, including new change, status, instructions, and context. These executions are restricted to the openspec namespace by the allowed-tools configuration.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external files and tool-generated JSON outputs, which include instruction sets for the agent.
Ingestion points: Retrieves guidance from openspec instructions --json and reads existing artifact files (like spec.md or design.md) from the filesystem to establish context.
Boundary markers: The instructions advise the agent to treat certain blocks as internal constraints rather than file content, but there are no formal technical boundaries used to isolate untrusted data during ingestion.
Capability inventory: The agent has the capability to execute specific CLI commands and perform file-write operations within the project directory.
Sanitization: There is no mention of sanitization or validation logic for the content read from artifacts or instruction fields.
[DYNAMIC_EXECUTION]: The skill logic includes a directive to invoke a specific skill or command if the instruction field in the tool's output delegates the creation of an artifact to one.

openspec-propose