The Agent Skills Directory

Indirect Prompt Injection Surface: The skill performs codebase analysis by reading local files to identify improvement opportunities like TODO comments or code patterns. This ingestion of untrusted data represents a surface where hidden instructions in the codebase could potentially influence the agent's behavior during task creation or implementation phases.
Command Execution: The skill executes shell commands using the npx openspec utility to interact with the project's change management system. While these are intended operations for the tool, they involve subprocess execution and interaction with external package registries.

openspec-onboard