openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and analyze codebase files and OpenSpec markdown artifacts (proposals, designs, specs) to provide context for discussions. This creates an ingestion surface for indirect prompt injection if an attacker embeds malicious instructions within the project files being investigated.
- Ingestion points: Codebase files and markdown files located in
openspec/changes/. - Boundary markers: The instructions lack explicit delimiters or 'ignore' instructions for the content read from files.
- Capability inventory: The skill can execute the
openspecCLI and write/update markdown files in the repository. - Sanitization: No explicit sanitization or validation logic is defined for the ingested file content.
- [COMMAND_EXECUTION]: The skill uses the
openspec list --jsoncommand to gather context about active changes. This is a legitimate use of a local CLI tool relevant to the skill's primary function, though it relies on the local environment having theopenspectool installed.
Audit Metadata