openspec-replan
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a 'human-in-the-loop' workflow where any proposed changes to the project files (such as tasks.md or proposal.md) must be approved by the user before being applied. It also includes specific UI bug workarounds for the AskUserQuestion tool to ensure user intent is captured correctly.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it reads and processes external data from several project files. 1. Ingestion points: File reads from 'openspec/changes/{change-id}/tasks.md', 'proposal.md', 'specs', 'openspec/project.md', 'CLAUDE.md', and 'settings.json' (all defined in SKILL.md). 2. Boundary markers: Absent; the skill does not use specific delimiters or instructions to ignore embedded commands within these files. 3. Capability inventory: The skill utilizes Write, Edit, and Bash tools (defined in SKILL.md) to modify the filesystem and execute project-related commands. 4. Sanitization: There is no evidence of sanitization or validation of the ingested file content before it is interpolated into the agent's context.
Audit Metadata