The Agent Skills Directory

Command Execution: The skill executes the command npx openspec list --json to retrieve the current state of OpenSpec artifacts. This is a functional requirement for the skill to provide relevant context to the user.
External Package Management: The skill utilizes npx to invoke the openspec tool, which typically involves fetching the package from the npm registry. This is a standard deployment pattern for Node.js-based command-line utilities.
Indirect Prompt Injection Surface: The skill is instructed to read files and investigate the codebase to ground its suggestions in the actual project structure.
Ingestion points: Codebase investigation and file reading as specified in SKILL.md.
Boundary markers: The skill does not define specific markers to separate ingested file content from its internal instructions.
Capability inventory: The skill can execute CLI commands and generate documentation artifacts (OpenSpec artifacts).
Sanitization: No explicit sanitization or filtering is applied to the content read from files. The risk is mitigated by the skill's core directive which explicitly forbids the agent from writing or implementing application code while in explore mode.

openspec-explore