openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to investigate the project codebase, read existing specs, designs, and configuration files to provide context for exploration. This ingestion of external, potentially untrusted content from the filesystem creates a surface for indirect prompt injection attacks.
- Ingestion points: Source code, OpenSpec artifacts (spec.md, design.md, proposal.md, tasks.md), and openspec/config.yaml.
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when reading these files.
- Capability inventory: The skill uses the openspec CLI (via Bash) which has capabilities to create new change directories and write artifact files. Although the skill mandates user confirmation for write actions, the potential for an injected instruction to influence the thinking or recommendations remains.
- Sanitization: There is no evidence of sanitization or filtering of the content read from files before it is processed by the agent.
Audit Metadata