The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process external project artifacts including proposals, specifications, and design documents retrieved via the openspec CLI. If these files originate from an untrusted source or a shared repository, they could contain embedded instructions intended to override the agent's behavior during the implementation phase.
Ingestion points: Artifacts specified in the contextFiles array returned by the openspec instructions apply command (identified in Step 4).
Boundary markers: Absent. There are no explicit instructions for the agent to ignore or delimit natural language instructions found within the project artifacts.
Capability inventory: The skill allows the agent to execute shell commands (restricted to the openspec binary) and perform file system modifications to implement tasks.
Sanitization: Absent. The agent processes the raw content of the context files to determine implementation steps.
[COMMAND_EXECUTION]: The skill extensively uses the openspec CLI to manage state, retrieve instructions, and validate changes. The platform's allowed-tools configuration Bash(openspec:*) provides a security boundary by restricting the agent's shell access to only the openspec command suite.

openspec-apply-change