openspec-ff-change
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the local project environment, including source code and existing documentation, alongside instructions generated by the OpenSpec CLI. This ingestion surface is vulnerable to indirect prompt injection if malicious instructions are embedded within the project files.
- Ingestion points: Instructions from
openspec instructions(context, rules, instructions), existing artifacts, and project implementation files. - Boundary markers: The skill differentiates between constraints and content but does not use explicit boundary markers or "ignore instructions" wrappers for processed data.
- Capability inventory: The skill utilizes
Bash(openspec:*)and performs file system writes to generate artifacts. - Sanitization: No explicit sanitization or filtering of ingested project data is implemented.
- [DYNAMIC_EXECUTION]: The workflow allows for the dynamic invocation of other skills or shell commands based on the content of the
instructionfield returned by the CLI at runtime. While scoped to artifact creation, this enables runtime execution of commands derived from external data.
Audit Metadata