openspec-to-prompts
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- Prompt Injection (LOW): Vulnerable to Indirect Prompt Injection (Category 8).
- Ingestion points: Reads specification files including
tasks.md,proposal.md, and variousspec.mdfiles from theopenspec/changes/{change-id}/directory tree. - Boundary markers: Absent. The skill does not define specific delimiters or instructional guards to isolate the data read from files from the agent's logic.
- Capability inventory: Performs multiple file-system reads and writes, and invokes several sub-skills (
prd-lite,prd-clarifier,prd-to-ux,ux-spec-to-prompts) to process and generate content. - Sanitization: Absent. The skill logic does not mention escaping or validating the content of the specification files before using them to drive the design pipeline.
Audit Metadata