OpenSpec

Spec-driven development with OpenSpec CLI. Use when building features, migrations, refactors, or any structured development work. Manages proposal → specs → design → tasks → implementation workflows. Supports custom schemas (TDD, rapid, etc.). Trigger on requests involving feature planning, spec writing, change management, or when /opsx commands are mentioned.

This skill appears to be what it says: a CLI-based spec/workflow helper that writes artifacts into your project. Before you install or run it: 1) Verify the npm package (@fission-ai/openspec) on the npm registry or GitHub — check publisher, source code, and recent versions. 2) Prefer non-global usage (npx or local install) or inspect the package contents before running a global install. 3) When you run the CLI, review any files it creates (openspec/, openspec/config.yaml, .claude/skills/*) for secrets, endpoints, or unexpected scripts before adding them to source control. 4) If you need higher assurance, run the install in an isolated environment (container/VM) and inspect the package source and behavior there. If you want, I can list the concrete checks to run on the npm package or draft a safe install procedure (npx, sandboxed run).

Type: OpenClaw Skill Name: openspec Version: 1.0.0 The skill bundle instructs the AI agent to install a global npm package (`npm install -g @fission-ai/openspec@latest`) as part of its setup in `SKILL.md`. While this action is plausibly needed for the stated purpose of using the OpenSpec CLI tool, installing global packages from external registries introduces a supply chain risk. There is no clear evidence of intentional malicious behavior like data exfiltration or persistence, but the instruction to install external code globally without further scrutiny falls under 'risky capabilities without clear malicious intent'.