openspec-archive-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and follow instructions from external sources via
openspec instructions archiveandopenspec instructions specs(Step 1 and Step 4). These are treated as "prompt-level behavior contracts," creating a surface where malicious project files could attempt to override the agent's behavior during the archiving process. - Ingestion points: Shell command outputs from
openspec instructions archive --change "<name>" --jsonandopenspec instructions specs --change "<name>" --jsonare parsed and considered as behavioral guidance. - Boundary markers: The skill includes explicit instructions for the agent to keep this external data separate from built-in steps, report conflicts, and avoid copying text verbatim.
- Capability inventory: The skill can execute shell commands (
openspec,mkdir,mv), read files (tasks.md), and trigger theopenspec-sync-specsworkflow. - Sanitization: The skill implements logic-based filtering by instructing the agent to ignore conflicting or inapplicable guidance and report such instances to the user.
- [COMMAND_EXECUTION]: The skill uses shell commands to move directories and interact with the OpenSpec CLI. User-supplied inputs like the change name and store ID are interpolated into these commands (e.g.,
mv "<changeRoot>" "<target-name>"). While variables are double-quoted, this pattern relies on the agent platform's underlying shell handler to prevent command injection via malicious input characters.
Audit Metadata