openspec-archive-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions explicitly direct the agent to fetch, read, and apply behavior-modifying data from external sources at runtime, creating a vulnerability surface where malicious data could influence agent actions.
- Ingestion points: The skill ingests data from the output of
openspec instructions archive --json,openspec status --json,openspec instructions specs --json, and the localtasks.mdfile (relative to the project root). - Boundary markers: The skill includes instructions to separate external guidance from built-in steps, but these are natural language constraints which can be bypassed by sophisticated adversarial data. It explicitly tells the agent to treat
contextas a "required prompt-level input". - Capability inventory: The skill has access to the
Bash(openspec:*)toolset and performs filesystem operations including reading files, creating directories (mkdir), and moving directories (mv). - Sanitization: There are explicit instructions to ignore guidance that conflicts with controlling inputs (like paths and CLI contracts) and to avoid copying the instruction text verbatim into outputs, which serves as a basic form of sanitization.
Audit Metadata