openspec-sync-specs
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates the synchronization of specification documents using a specialized CLI tool. All identified behaviors align with its stated purpose of managing project documentation.
- [COMMAND_EXECUTION]: The skill utilizes the
openspecCLI (e.g.,openspec status,openspec list,openspec validate) to manage specifications. These operations are conducted locally and are restricted by theallowed-toolsconfiguration to theopenspeccommand namespace. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external "delta spec" files to update "main specs." While this involves ingesting potentially untrusted content, the skill applies structured semantic merging according to a predefined markdown format, which is the primary intended function of the synchronization process.
Audit Metadata