openspec-explore
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from the local codebase and OpenSpec configuration files, which creates an attack surface for indirect prompt injection if those files contain malicious instructions.
- Ingestion points: The skill reads project context from openspec/config.yaml (or config.yml) and accesses existing artifacts through resolved paths in the codebase.
- Boundary markers: No explicit boundary markers or delimiters are defined to isolate external content from the agent's core instructions.
- Capability inventory: The agent has the capability to execute openspec CLI commands and write design artifacts to the local filesystem.
- Sanitization: There is no evidence of sanitization or validation performed on the ingested file content before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill relies on the openspec CLI to manage state, list changes, and scaffold new artifacts. It executes multiple subcommands based on user input and project status. These operations are restricted by the platform to the openspec command prefix via the allowed-tools configuration.
Audit Metadata