openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from local project files, such as config.yaml and existing markdown artifacts, to ground its thinking process. This presents a potential surface where malicious instructions embedded in project documentation could attempt to influence the agent's behavior during exploration.
- Ingestion points: SKILL.md (References reading <root.path>/openspec/config.yaml and files found in artifactPaths).
- Boundary markers: The instructions provide a clear directive to treat project context and rules as constraints and specifically forbid copying them into outputs.
- Capability inventory: The agent's actions are scoped to the openspec CLI, which supports file reading and writing within the project structure.
- Sanitization: The skill relies on the agent's internal reasoning to handle document content without explicit programmatic sanitization of the markdown files.
Audit Metadata