openspec-archive-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing multiple shell commands including
openspec,mkdir,cp, andmvto manage workflow artifacts and move directories on the local file system.\n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from external sources and uses that information to drive logic and construct shell commands.\n - Ingestion points: Output from
openspec list --json,openspec status --json, and the content oftasks.mdfiles (specifically checking for checkbox patterns).\n - Boundary markers: There are no explicit delimiters or instructions provided to the agent to differentiate untrusted external content from system instructions.\n
- Capability inventory: The skill utilizes subprocess calls to the
openspecCLI and file system capabilities including directory creation (mkdir), file copying (cp), and directory movement (mv).\n - Sanitization: While some command arguments are wrapped in quotes (e.g.,
--change "<name>"), others like themvandmkdirpaths interpolate variables directly, which could lead to path traversal or command injection if the input strings (change names or capability names) are maliciously crafted.
Audit Metadata