openspec-ff-change
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external command outputs and existing files to drive artifact generation, which presents a surface for indirect prompt injection attacks.\n
- Ingestion points: The skill reads JSON data from the
openspec instructionscommand (includingcontext,rules,template, andinstructionfields) and the content of local dependency artifacts.\n - Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore' markers to wrap or separate external content from the agent's core instructions.\n
- Capability inventory: The skill has the capability to write files to the local file system and execute shell commands through the
openspecCLI.\n - Sanitization: Absent. There is no evidence of filtering or escaping logic applied to the external data before it is processed by the agent.\n- [COMMAND_EXECUTION]: The skill executes multiple commands using the
openspecCLI, which is the primary interface for its operations.\n - Evidence: The automation logic uses
openspec new change,openspec status, andopenspec instructionsto manage the project state and retrieve metadata.
Audit Metadata