openspec-sync-specs
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external "delta spec" markdown files and merges their content into main specification files. This presents a surface where instructions hidden within the delta specs could attempt to influence the agent's behavior or override the intended workflow.
- Ingestion points: Delta spec files found via
artifactPaths.specs.existingOutputPaths(e.g.,specs/capability/spec.md) and theopenspec instructionscommand output. - Boundary markers: The skill provides a "Delta Spec Format Reference" defining specific headers (
## ADDED Requirements, etc.) to delimit data, and explicitly warns the agent that external rules are not operational guidance. - Capability inventory: The agent can read/write files and execute various
openspecCLI subcommands (status, list, instructions, validate, store) using the Bash tool. - Sanitization: The instructions explicitly forbid the agent from allowing external rules to change selected roots, delta paths, or workflow steps, and require the agent to use judgment when merging changes rather than overwriting.
Audit Metadata