openspec-sync-specs
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and interpret "delta specs" from project files located at
openspec/changes/<name>/specs/*/spec.mdand apply those changes to "main specs". Because the agent is instructed to "understand the intended changes" and "apply changes intelligently," it may be susceptible to instructions embedded within the delta spec content that attempt to manipulate the agent's behavior or filesystem actions. - Ingestion points: Reads content from local Markdown files in the
openspec/changes/directory. - Boundary markers: The instructions lack explicit delimiters or warnings to ignore potential instructions embedded within the data being processed.
- Capability inventory: The agent has the capability to read and write files within the project directory and execute the
openspecCLI tool. - Sanitization: No evidence of content filtering, escaping, or validation of the ingested data is present.
Audit Metadata