openspec-archive-change
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and follow external instructions that could potentially be used to manipulate agent behavior.
- Ingestion points: Ingests
context,operationGuidance, andrulesthrough theopenspec instructionsCLI commands in steps 1 and 4. - Boundary markers: Relies on natural language advisory instructions for the agent to detect and report conflicts, providing limited protection against malicious payloads.
- Capability inventory: Possesses capabilities including shell command execution, file system access, and directory management.
- Sanitization: Lacks a defined process for sanitizing external instruction data before it is integrated into the prompt context.
- [COMMAND_EXECUTION]: The skill executes shell commands using variables that are populated from user input or external CLI output.
- Evidence: The use of
mvwith variables like<changeRoot>and<target-name>in step 5 presents a risk of command injection if these strings contain shell metacharacters that are not properly escaped by the underlying execution environment.
Audit Metadata