openspec-explore
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
openspecCLI (specificallyopenspec list --json) to retrieve project state. This command is restricted to the skill's own tooling and does not involve arbitrary shell execution. - [PROMPT_INJECTION]: The skill processes codebase files and OpenSpec artifacts, creating a surface for indirect prompt injection.
- Ingestion points: Files located in
openspec/changes/and the codebase generally (e.g.,proposal.md,design.md,tasks.md). - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands for external content.
- Capability inventory: The agent can read files and write OpenSpec artifacts. The skill contains a strong negative constraint against implementing application code or features.
- Sanitization: No specific sanitization or validation mechanisms for ingested file content are described.
Audit Metadata