openspec-new-change
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided descriptions to derive change names and selects schemas based on user input, which are then interpolated into shell commands. Ingestion points: User descriptions of features or fixes and schema selections in SKILL.md. Boundary markers: Absent for raw user input. Capability inventory: Executes shell commands using the openspec CLI via the Bash tool. Sanitization: The instructions require the agent to transform user input into a 'kebab-case' format and validate it before use in commands, providing a layer of protection against shell injection.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to run various openspec CLI commands (e.g., new change, status, instructions) to manage the artifact-driven workflow. These commands are scoped to the openspec binary as per the allowed-tools configuration.
Audit Metadata