openspec-propose
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands by interpolating user-provided strings such as change names and store IDs into command templates like 'openspec new change '. If these inputs are not sanitized by the execution environment, it could lead to command injection, although the allowed tools are restricted to the openspec namespace.
- [DYNAMIC_EXECUTION]: The skill dynamically delegates artifact creation to other skills or commands if directed by the 'instruction' field returned by the 'openspec instructions' CLI tool at runtime, introducing a dependency on external data for the execution path.
- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data that may contain instructions intended to influence the agent's behavior.
- Ingestion points: Processes JSON output from 'openspec status' and 'openspec instructions', and reads artifact files like proposal.md and spec.md from the local filesystem.
- Boundary markers: The skill provides explicit instructions to the agent to treat 'context' and 'rules' blocks as internal constraints rather than content for output files.
- Capability inventory: Performs CLI command execution and local filesystem writes.
- Sanitization: There is no explicit evidence of sanitization or integrity verification for the data ingested from the CLI tool or local project files.
Audit Metadata