The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the user's local codebase and OpenSpec project artifacts, which could contain malicious instructions.
Ingestion points: The skill instructions specify that the agent "may read files, search code, and investigate the codebase" and specifically read OpenSpec artifacts like proposal.md, design.md, and tasks.md.
Boundary markers: The skill includes explicit negative constraints intended to limit the agent's actions, such as "NEVER write code or implement features" and "Don't implement
Never write code or implement features."
Capability inventory: The agent has the ability to read arbitrary files in the codebase, write markdown files to specific project directories, and execute the openspec CLI tool.
Sanitization: The skill relies on instructional guardrails to prevent the agent from obeying instructions embedded in the data it reads, rather than technical validation or filtering.
[COMMAND_EXECUTION]: The skill uses the openspec command-line utility to retrieve project information.
Evidence: The instruction block contains the command openspec list --json to check for active changes.
[EXTERNAL_DOWNLOADS]: The skill requires a specific external command-line tool provided by the vendor to be installed on the system.
Evidence: The frontmatter specifies compatibility: Requires openspec CLI.

openspec-explore