openspec-archive-change
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: User-provided identifiers (e.g., change names) are interpolated directly into bash command strings within the instructions (e.g.,
openspec status --change "<name>" --json). While the use of double quotes provides some shell-level grouping, the lack of explicit validation or sanitization instructions for these inputs creates a potential command injection surface if the agent does not properly escape user-provided strings. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data returned by the
openspec instructions archivecommand. It specifically instructs the agent to treat thecontextandoperationGuidancefields from the JSON output as behavioral contracts. This introduces a surface where data stored in the repository (which may be attacker-controlled in shared environments) can influence the agent's logic. - Ingestion points: Output of
openspec instructions archivein SKILL.md (Step 1). - Boundary markers: Present; the skill includes explicit instructions for resolving conflicts between external guidance and the skill's controlling logic (e.g., "report the conflict and preserve the controlling value").
- Capability inventory: Shell command execution including
openspecCLI operations, directory creation (mkdir), and file system movements (mv). - Sanitization: Absent; the skill does not specify any validation or sanitization of the JSON-provided guidance before it is incorporated into the prompt context.
Audit Metadata