openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill leverages the Bash(openspec:*) tool to execute local CLI commands including openspec store list, openspec status, openspec instructions, and openspec new change. These commands are used to manage project state and scaffold new change proposals based on user input.\n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of reading and processing external codebase files.\n
- Ingestion points: The agent reads openspec/config.yaml, config.yml, and existing artifact files (such as design.md, proposal.md, tasks.md) from the local filesystem.\n
- Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following malicious instructions potentially embedded within these project files.\n
- Capability inventory: The skill allows the agent to execute openspec CLI commands, read project files, and write Markdown artifacts to the filesystem.\n
- Sanitization: The skill lacks mechanisms to sanitize or filter the content of the files it reads before providing them to the agent's context.
Audit Metadata