openspec-explore

Pass

Audited by Gen Agent Trust Hub on Feb 13, 2026

Risk Level: LOWNO_CODE
Full Analysis

The SKILL.md file defines a behavioral mode for the AI. It contains no executable code or scripts that the AI would run directly, other than referencing a local openspec list --json command. This command is intended to interact with a locally installed openspec CLI and read local data, not to exfiltrate information to external servers. The skill explicitly forbids the AI from writing code or implementing features, which is a strong safety measure. The use of 'IMPORTANT' is for self-imposed constraints on the AI's behavior, not for prompt injection. No obfuscation, privilege escalation, persistence mechanisms, or time-delayed attacks were detected. The skill relies on the user having the openspec CLI installed, but the skill itself does not attempt to download or install this dependency from any source, trusted or otherwise. Therefore, no direct security threats are identified within the skill's instructions.

Audit Metadata
Risk Level
LOW
Analyzed
Feb 13, 2026, 01:47 AM