openspec-sync-specs
Pass
Audited by Gen Agent Trust Hub on Mar 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the openspec CLI (e.g.,
openspec list --json) to retrieve a list of available changes. This execution is limited to the specialized tool required for the skill's primary purpose. - [PROMPT_INJECTION]: The skill processes content from Markdown files to update specifications, creating a surface for potential indirect prompt injection. Ingestion points: delta specification files located at
openspec/changes/<name>/specs/*/spec.md. Boundary markers: None explicitly defined in the instructions to the agent. Capability inventory: Includes file read and write operations within the project directory and execution of the openspec CLI. Sanitization: No specific content sanitization or validation is described beyond the merge logic.
Audit Metadata