The Agent Skills Directory

[Indirect Prompt Injection] (LOW): The skill reads and follows instructions from multiple project files which could be manipulated by an attacker to execute malicious commands. * Ingestion points: openspec/project.md, proposal.md, tasks.md, specs/*.md. * Boundary markers: Absent; the agent is explicitly told to 'Follow tasks.md step by step'. * Capability inventory: Bash, Write, Edit, Read, Glob, Grep. * Sanitization: None; the agent treats external markdown content as authoritative instructions.
[Command Execution] (SAFE): The skill uses the Bash tool for routine development operations such as git branch management and running linter/test suites. These commands are typical for the workflow and do not show inherent malicious intent.

openspec-apply