openspec-ff-change
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION] (SAFE): The skill executes local 'openspec' CLI commands to create and manage project files. It utilizes double-quoted variable interpolation (e.g., "") which helps mitigate basic shell injection vulnerabilities.
- [DATA_EXFILTRATION] (SAFE): No network operations or attempts to access sensitive system files (like SSH keys or AWS credentials) were found. All file operations are confined to the 'openspec/changes/' directory.
- [EXTERNAL_DOWNLOADS] (SAFE): The skill does not download or execute external scripts, nor does it perform any automated package installations.
- [PROMPT_INJECTION] (SAFE): No instructions designed to override AI safety filters or hijack agent behavior were detected in the skill body or metadata.
Audit Metadata