openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the openspec CLI to perform operations such as listing changes, checking status, and generating new design artifacts. The allowed-tools configuration specifically restricts bash usage to the openspec command namespace.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (the local codebase and configuration files) to provide context for exploration, creating a potential vector for indirect prompt injection.
- Ingestion points: Reads arbitrary files from the user's codebase, openspec/config.yaml, and existing artifacts within the openspec/changes/ directory.
- Boundary markers: No specific boundary markers or delimiters are defined to separate untrusted codebase content from the agent's instructions.
- Capability inventory: The agent can execute CLI commands via bash and write new markdown-based artifacts to the filesystem.
- Sanitization: The skill instructs the agent to apply rules found in the project's configuration file as constraints for artifact creation, providing a layer of validation.
Audit Metadata