openspec-explore
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read external codebase files and OpenSpec artifacts, creating an attack surface where malicious content in those files could influence the agent's behavior.
- Ingestion points: Reads local codebase files and markdown artifacts in the
openspec/changes/directory. - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded content.
- Capability inventory: The agent can read files, execute the
openspecCLI, and write markdown files. - Sanitization: No explicit sanitization of ingested content is mentioned.- [COMMAND_EXECUTION]: The skill executes a local CLI tool to retrieve project context.
- Evidence: Uses
openspec list --jsonto identify active changes and their statuses.
Audit Metadata