openspec-design
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingest data from openspec/changes/{id}/proposal.md which is potentially attacker-controlled content. Malicious instructions within this file could attempt to subvert the agent's design logic.
- Ingestion points: openspec/changes/{id}/proposal.md (SKILL.md).
- Boundary markers: Absent. The skill reads the file content directly into the context.
- Capability inventory: The agent has the ability to read and write files within the project structure.
- Sanitization: No explicit sanitization or validation of the proposal content is performed before processing.
- [DATA_EXFILTRATION]: The skill uses the {id} variable from user-provided $ARGUMENTS to construct file paths for reading and writing (e.g., openspec/changes/{id}/proposal.md). This presents a potential path traversal risk if the agent does not sanitize the input, although the impact is limited to the file system scope accessible to the agent.
Audit Metadata