openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local repository files which could contain malicious instructions designed to subvert agent behavior.\n
- Ingestion points: Reads content from
openspec/changes/,specs/, and other project files referenced inSKILL.md.\n - Boundary markers: Absent; no delimiters are defined to separate untrusted file content from instructions.\n
- Capability inventory: The skill can read files, search code, execute specific CLI commands (
openspec list), and write markdown artifacts.\n - Sanitization: Absent; no mention of content filtering or escaping for ingested data.\n- [COMMAND_EXECUTION]: The skill uses the
openspec list --jsoncommand to gather project context. This is a routine diagnostic operation for the associated tooling.
Audit Metadata