openspec-plus-tasks
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
openspecCLI tool to fetch structural templates. The command uses a variable input (--change <name>), which could theoretically be an injection point depending on platform sanitization. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project documents to guide task generation, creating a surface for indirect prompt injection.
- Ingestion points: Reads
Proposal,Specs,Design, andAGENTS.mdfiles into the context. - Boundary markers: None provided in the skill instructions to delimit external content from system directives.
- Capability inventory: Executes local shell commands, performs subagent reviews, and writes files to the local directory.
- Sanitization: No validation or sanitization of ingested content is performed before processing.
Audit Metadata