openspec-archive-change
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface by accepting external natural language inputs that influence prompt-level execution behavior.
- Ingestion points: In
SKILL.md(Step 1), the commandopenspec instructions archive --change "<name>" --jsonloads external data fields (contextandoperationGuidance) into the agent's prompt context. - Boundary markers: Partial boundary instructions are present; the skill instructs the agent to treat
contextandoperationGuidanceas behavior contracts, report conflicts, and avoid copying the text verbatim, which acts as a logical restriction but does not fully neutralize adversarial manipulation. - Capability inventory: The skill has access to shell tools capable of executing filesystem operations (
mkdir -p,mv) and managing repositories via theopenspecCLI tool. - Sanitization: No formal sanitization or structural validation is performed on the natural language values inside
contextoroperationGuidancebefore the agent considers and follows them.
Audit Metadata