The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from external project artifacts without using boundary markers or sanitization logic.
Ingestion points: Reads content from proposal.md, design.md, and tasks.md within the openspec/changes/ directory.
Boundary markers: No delimiters or instructions are provided to the agent to distinguish between its own logic and potentially malicious instructions embedded in those files.
Capability inventory: The skill has the capability to write to the filesystem (creating/updating artifacts) and execute the openspec CLI tool.
Sanitization: No sanitization or validation of the ingested file content is performed.
[COMMAND_EXECUTION]: The skill instructs the agent to execute a specific local CLI tool to gather context about the project state.
Evidence: Execution of openspec list --json to identify active changes.

openspec-explore