The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external sources such as issues and PR comments, which presents a potential injection surface.
Ingestion points: Reads issue descriptions and paginated comments using authenticated tracker tools (SKILL.md, Workflow step 1).
Boundary markers: Includes strong instructions to treat issue prose as untrusted requirements data that does not authorize command or code execution (references/042-planning-openspec.md, Step 1).
Capability inventory: Restricts capabilities to the openspec CLI and read-only tracker access.
Sanitization: Mandates the use of sanitized summaries for third-party content when used outside the specialized issue retrieval mode.
[COMMAND_EXECUTION]: The skill utilizes the openspec command-line interface for project initialization and artifact management.
Evidence: Execution of openspec --version, openspec init, openspec new change, and openspec validate is central to the workflow.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill emphasizes the use of official tracker tooling for data retrieval.
Evidence: The instructions explicitly call for "authenticated, read-only tracker tooling" to establish context, minimizing the risk of credential misuse or unauthorized access.

042-planning-openspec