openspec-develop
Warn
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The status command executes a shell command using the change-id argument:
openspec show {change-id}. If the platform does not sanitize the input provided to the command, an attacker can use shell metacharacters (e.g., semicolon, backticks) to execute arbitrary commands with the Bash tool. - [PROMPT_INJECTION]: The skill reads task descriptions and implementation requirements from external markdown files and is instructed to 'Implement the task' based on that content. This provides a direct path for indirect prompt injection where malicious instructions inside project files can hijack the agent's workflow.
- Ingestion points: openspec/changes/{change-id}/tasks.md, openspec/changes/{change-id}/design.md, openspec/project.md
- Boundary markers: Absent; the agent treats file content as a direct source of tasks to execute.
- Capability inventory: Bash, Write, Edit, Read, Glob, Grep
- Sanitization: None detected.
Audit Metadata