openspec-explore

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the openspec CLI to perform operations such as listing changes, checking status, and generating new design artifacts. The allowed-tools configuration specifically restricts bash usage to the openspec command namespace.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (the local codebase and configuration files) to provide context for exploration, creating a potential vector for indirect prompt injection.
  • Ingestion points: Reads arbitrary files from the user's codebase, openspec/config.yaml, and existing artifacts within the openspec/changes/ directory.
  • Boundary markers: No specific boundary markers or delimiters are defined to separate untrusted codebase content from the agent's instructions.
  • Capability inventory: The agent can execute CLI commands via bash and write new markdown-based artifacts to the filesystem.
  • Sanitization: The skill instructs the agent to apply rules found in the project's configuration file as constraints for artifact creation, providing a layer of validation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 11:55 PM
Security Audit — agent-trust-hub — openspec-explore