openspec-explore
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local codebase, configuration files (e.g.,
openspec/config.yaml), and instructions generated by theopenspecCLI tool. - Ingestion points: Reads project source files, repository configuration, and command outputs from
openspec statusandopenspec instructions. - Boundary markers: The instructions do not specify the use of delimiters or ignore-markers when reading external file content or tool outputs.
- Capability inventory: The agent can read codebase files and write documentation artifacts (proposals, designs, tasks) via the
openspecCLI. - Sanitization: No explicit sanitization or validation of content read from the file system or tool outputs is performed before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill uses the
openspecCLI to perform actions like listing registered stores, initializing new changes, and retrieving artifact instructions. These commands are restricted to theopenspecbinary via the allowed-tools configuration.
Audit Metadata