openspec-continue-change
Warn
Audited by Gen Agent Trust Hub on Mar 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using the
openspecCLI, such asopenspec status --change "<name>"andopenspec instructions <artifact-id>. The variables<name>and<artifact-id>can be derived from user input or external tool output. If these inputs contain shell metacharacters (e.g.,;,&&,|), they could be used to execute arbitrary commands on the host system. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting data from external sources to guide its behavior.
- Ingestion points: Data enters the context via
openspecCLI outputs and the content of files specified in thedependenciesfield. - Boundary markers: There are no delimiters or specific instructions provided to the agent to ignore potentially malicious instructions embedded within the ingested data.
- Capability inventory: The skill has the capability to execute CLI commands and write files to arbitrary locations defined by the
outputPathfield. - Sanitization: No sanitization or validation is performed on the content read from external files or tool outputs before it is used to generate new artifacts.
Audit Metadata