openspec-sync-specs
Warn
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands (e.g.,
openspec status --change "<name>") using variables derived from user input and file content. While the instructions suggest using double quotes, these variables are not explicitly sanitized for shell metacharacters, potentially allowing command or argument injection if the agent does not properly escape the values.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by processing untrusted data from external specification files to perform intelligent merges.\n - Ingestion points: The agent reads 'delta spec' files identified in the
artifactPaths.specs.existingOutputPathsfield (Step 4a).\n - Boundary markers: The skill does not provide specific delimiters or 'ignore' instructions to separate the specification content from the agent's logic, allowing content to potentially influence agent behavior.\n
- Capability inventory: The agent has the capability to write and modify files on the filesystem (Step 4c/d) and execute CLI tools via the Bash tool (Step 5).\n
- Sanitization: There is no evidence of sanitization or content validation performed on the delta specs before they are merged into the main specifications.
Audit Metadata