openspec-sync-specs

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill facilitates the synchronization of specification documents using a specialized CLI tool. All identified behaviors align with its stated purpose of managing project documentation.
  • [COMMAND_EXECUTION]: The skill utilizes the openspec CLI (e.g., openspec status, openspec list, openspec validate) to manage specifications. These operations are conducted locally and are restricted by the allowed-tools configuration to the openspec command namespace.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external "delta spec" files to update "main specs." While this involves ingesting potentially untrusted content, the skill applies structured semantic merging according to a predefined markdown format, which is the primary intended function of the synchronization process.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 11:41 AM