The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several local commands to manage and validate the OpenSpec environment. It runs openspec init to bootstrap the configuration, openspec schema validate to check schema integrity, and rg (ripgrep) to identify remaining placeholders. Additionally, it uses a Python one-liner (python3 -c 'import yaml,sys; yaml.safe_load(open(sys.argv[1]))') to safely validate YAML syntax.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow includes reading local project files, such as README.md and CLAUDE.md, to determine project constraints and tooling requirements. This creates an ingestion surface for potential indirect prompt injection from repository content.
Ingestion points: Project-level documentation and build configuration files (e.g., README.md, CLAUDE.md, AGENTS.md) as defined in the SKILL.md workflow.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands in the ingested files.
Capability inventory: The skill has the ability to write files to the repository and execute CLI tools including openspec, python3, and rg.
Sanitization: The agent is not instructed to sanitize or validate the content extracted from project documentation before using it to inform configuration decisions.

openspec-bootstrap