openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accesses local project configuration files and existing artifacts to build context for the agent. 1. Ingestion points: openspec/config.yaml, openspec/config.yml, and artifact files identified via openspec list. 2. Boundary markers: No specific delimiters or 'ignore' instructions are specified for reading these files. 3. Capability inventory: The agent can execute openspec CLI subcommands such as 'new change', 'status', and 'instructions'. 4. Sanitization: The skill relies on the openspec CLI tool to safely process its inputs.
- [SAFE]: The skill includes strong guardrails, explicitly forbidding the implementation of features or writing of application code. Tool access is strictly limited to the openspec CLI via a restricted allowed-tools list, preventing the use of more dangerous system-level utilities.
Audit Metadata