openspec-archive-change
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard shell commands
mkdirandmvto organize and archive change directories. These operations are restricted to the local filesystem within the project's own directory structure. - [PROMPT_INJECTION]: The skill ingests data from local markdown files (
tasks.md) and CLI output (openspec status --json). This represents an indirect prompt injection surface; however, the skill mitigates risk by using theAskUserQuestiontool to require explicit user confirmation before proceeding when incomplete tasks or artifacts are detected. - [SAFE]: All external tool dependencies (the
openspecCLI) and file paths belong to the skill author's own ecosystem, representing legitimate vendor functionality.
Audit Metadata