openspec-implementation
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to run various shell commands for development tasks, including file operations (
cat,find,echo), testing tools (npm,pytest,cargo), and local network requests (curl). While these are standard for implementation tasks, they represent a significant capability tier. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from external files which could serve as a vector for indirect prompt injection.
- Ingestion points: Reads content from
spec/changes/{change-id}/proposal.md,tasks.md, and files withinspec/changes/{change-id}/specs/inSKILL.md. - Boundary markers: Absent. The instructions do not include specific delimiters or warnings to ignore potentially malicious instructions embedded within the proposal or task files.
- Capability inventory: The skill can execute arbitrary shell commands (e.g., via the execution of tasks described in the files), perform file system reads and writes, and initiate network requests to
localhost. - Sanitization: Absent. There is no mention of filtering, escaping, or validating the instructions retrieved from the external spec files before the agent acts upon them.
Audit Metadata