openspec-propose
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources including the
openspecCLI tool output and existing project files. - Ingestion points: Untrusted data enters the agent context through the outputs of
openspec status --json,openspec instructions --json,openspec context --json, and by reading dependency files (markdown artifacts) directly from the file system. - Boundary markers: The skill includes a detailed "Planning boundary" instruction that explicitly prohibits implementation or code editing, even if the user request asks for it. It also instructs the agent to treat
contextandrulesprovided by the CLI as internal constraints rather than content to be copied. - Capability inventory: The skill is authorized to execute
Bashcommands restricted to theopenspecCLI and has the capability to write markdown artifact files to the file system. - Sanitization: The skill relies on the structured JSON output and templates provided by the
openspecCLI to guide artifact generation.
Audit Metadata