The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and process data from external sources, creating a surface for indirect prompt injection attacks where malicious instructions hidden in the codebase could be executed by the agent.
Ingestion points: The skill explicitly directs the agent to "read files, search code, and investigate the codebase" as well as to read project-specific configuration from <root.path>/openspec/config.yaml or config.yml (found in SKILL.md).
Boundary markers: The skill provides instructions to treat project context as "constraints for you to follow, not content to reproduce" and warns the agent "do NOT copy them into the conversation or into any artifact you create."
Capability inventory: The skill utilizes the openspec CLI tool via Bash(openspec:*) to perform file system operations, such as scaffolding new changes, validating artifacts, and writing design documents and specifications to the project root (found in SKILL.md).
Sanitization: There is no mention of sanitization, filtering, or validation of the content read from the codebase or configuration files before it is used to inform the agent's thinking or generated outputs.
[COMMAND_EXECUTION]: The skill relies on the execution of the openspec CLI tool to manage project artifacts and state. While these are vendor-provided commands (openspec store, openspec new change, openspec status, etc.), they grant the agent the ability to interact with the local file system and repository metadata.

openspec-explore