The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local codebase, which could theoretically contain malicious instructions designed to influence the agent's behavior during the tutorial.
Ingestion points: The skill reads file contents from the src/ directory, scans for specific code comments (TODO, FIXME, HACK), and retrieves recent git log history as described in SKILL.md (Phase 2).
Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore embedded commands within the processed code snippets.
Capability inventory: The skill is capable of executing shell commands (openspec, git, mkdir) and performing file-write operations to update the project's documentation and source code.
Sanitization: No explicit sanitization or filtering of the ingested codebase content is performed before it is processed or used to generate proposals.
[COMMAND_EXECUTION]: The skill executes local system commands to manage the development workflow and verify tool availability.
Evidence: Commands include openspec --version, git log, openspec new change, mkdir, and openspec archive across various phases of the tutorial.
Risk: The command openspec new change "<derived-name>" in Phase 4 uses a name derived from the analyzed codebase tasks. While the skill is intended for interactive use, there is a theoretical risk of command injection if the task description contains shell metacharacters and the execution environment does not provide proper escaping.

openspec-onboard