The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes local OpenSpec artifacts such as proposals, designs, and specifications. These files are external to the skill's own logic and could potentially be modified by a malicious actor to include hidden instructions.
Ingestion points: The skill reads content from file paths identified through the openspec status command and incorporates this data into the agent's context (e.g., in SKILL.md under the 'When a change exists' section).
Boundary markers: The instructions do not define delimiters or explicit warnings to ignore instructions embedded within the processed artifacts.
Capability inventory: The skill can read local files, execute specific openspec CLI commands, and write to markdown-based artifacts. It is explicitly restricted from writing or modifying application source code.
Sanitization: There is no mention of sanitizing or validating the content of the ingested artifacts before processing.
[COMMAND_EXECUTION]: The skill uses the openspec CLI tool (e.g., openspec list --json, openspec status) to synchronize with the current project state and changes. This command execution is part of the intended integration with the vendor's OpenSpec system.

openspec-explore