openspec-to-td
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from OpenSpec markdown files to generate and execute CLI commands, creating a surface for indirect instructions to influence agent behavior.
- Ingestion points: The skill reads
proposal.md,tasks.md,spec.md, anddesign.mdfrom theopenspec/changes/directory to understand the intent and tasks of a change. - Boundary markers: The instructions do not define explicit delimiters or use specific markers to separate the content of these files from the agent's instructions, relying instead on the agent's internal reasoning.
- Capability inventory: The agent is empowered to execute shell commands via the
td(orbd) CLI tool, includingcreate,ws,log, anddep, which are driven by the parsed content of the external files. - Sanitization: There are no explicit sanitization or escaping protocols defined for the content extracted from markdown files before it is used in command arguments, although the skill does prompt the agent to analyze tasks for quality and risk before proceeding.
Audit Metadata