openspec-plus-proposal
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs an update check by fetching from
https://api.github.com/repos/sudokar/openspec-plus/releases/latest. Per [TRUST-SCOPE-RULE], GitHub is a well-known service, and this operation is considered safe. - [COMMAND_EXECUTION]: Instructions describe invoking subagents (e.g.,
Claude Code Agent(general-purpose),run_subagent(subagent_general)) for artifact review. While these are administrative tool calls, they represent the execution of external logic within the agent environment. - [METADATA_POISONING]: The skill includes instructions to ignore its own safety claims (e.g., 'Verdict: SAFE'). This is a self-referential pattern common in analyzed instruction files.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user requests and existing project files (
openspec/changes/,AGENTS.md, etc.) to generate proposals. This creates a surface for indirect prompt injection where malicious instructions in project documentation could influence the proposal generation process. Severity is LOW as it represents a vulnerability surface rather than an active exploit. - [SAFE]: Instructions to read/write local configuration files like
openspec/.plus/last-update-checkandopenspec/.plus/VERSIONare standard state management practices and present no security risk.
Audit Metadata