The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external project data which could contain malicious instructions designed to subvert the agent's behavior.
Ingestion points: The skill reads project-level configuration files (openspec/config.yaml) and existing OpenSpec artifacts (specs, designs, tasks) as part of its core exploration workflow.
Boundary markers: The skill does not define specific delimiters or "ignore instructions" wrappers for the data read from the local filesystem.
Capability inventory: The skill is authorized to use the openspec CLI to list project changes, read instructions, and write markdown files. It contains an explicit behavioral guardrail forbidding the writing of executable application code.
Sanitization: The instructions command the agent to treat external content solely as background constraints and explicitly forbids reproducing that content in new artifacts, which provides some mitigation against direct injection payload reflection.

openspec-explore