verify-openspec-docs
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill explicitly instructs a subagent to "Re-run the terminal commands shown" within documentation units. This behavior introduces a risk where malicious shell commands embedded in documentation files could be executed by the agent. The skill includes a mitigation suggestion to use "read-only commands" or "scratch directories," but the underlying capability depends on the agent's ability to execute arbitrary commands found in user-controlled content.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes documentation prose as external, untrusted data to guide agent behavior.
- Ingestion points: Documentation files identified by
<PAGE PATH>and<DOCS TREE ROOT>/README.md. - Boundary markers: Absent; the subagent reads the documentation content directly without escaping or delimiters to separate instructions from data.
- Capability inventory: The subagent can read files, execute shell commands, and run the
openspec validateutility. - Sanitization: No sanitization, filtering, or validation is performed on the documentation content before it is parsed and acted upon by the subagent.
Audit Metadata