The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files which could contain untrusted instructions if the codebase is compromised.
Ingestion points: SKILL.md instructs the agent to read openspec/changes/<name>/proposal.md, design.md, tasks.md, and specs/<capability>/spec.md to gather context.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the content of these files as untrusted or to ignore embedded instructions.
Capability inventory: The skill allows the agent to create or update OpenSpec artifacts (file system writes) if explicitly requested by the user.
Sanitization: The instructions do not specify any sanitization, filtering, or validation for the content ingested from the project files.
[COMMAND_EXECUTION]: The skill involves the execution of local system commands to retrieve environment state.
Evidence: The instructions direct the agent to run openspec list --json at the beginning of the interaction to identify active changes and schemas.

openspec-explore