The Agent Skills Directory

External Package Execution: The skill utilizes npx openspec to run its core functionality. This involves fetching the openspec package from the NPM registry at runtime. While common in development environments, executing remote packages is a potential security consideration that depends on the integrity of the registry and the package.
System Command Invocation: The skill executes shell commands to list changes, check status, and retrieve instructions. These commands interact with the local environment to manage project artifacts.
Data Processing and Content Generation: The skill ingests JSON data produced by the CLI—specifically the instructions and context fields—which it then uses to generate new markdown files. This data-driven approach creates a surface for indirect prompt injection, as the agent follows instructions provided by the external tool's output. The skill includes specific guardrails advising the agent not to copy metadata blocks into the final output, which serves as a basic control mechanism for this behavior.

openspec-continue-change