openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project-level files such as config.yaml, spec.md, and design.md, which may contain instructions from untrusted sources. The skill's filesystem write capabilities via the openspec CLI create an attack surface for indirect prompt injection.\n
- Ingestion points: SKILL.md directs the agent to read openspec/config.yaml, specification files in the specs/ directory, and existing artifacts like proposal.md and design.md.\n
- Boundary markers: Absent. There are no technical delimiters or explicit instructions to treat file content as data rather than instructions.\n
- Capability inventory: SKILL.md provides instructions for write-capable actions including creating new changes and artifacts via openspec CLI commands.\n
- Sanitization: Absent. No sanitization, validation, or filtering of the content read from files is described.\n- [EXTERNAL_DOWNLOADS]: The skill requires the openspec CLI, which is an external tool dependency.\n- [COMMAND_EXECUTION]: The skill instructs the agent to run shell commands that include user-provided inputs (such as change names), creating a potential risk for command injection if the input is not properly sanitized.
Audit Metadata