openspec-propose
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
openspecCLI to manage change sets and artifact generation. It passes user-provided values like change names, store IDs, and schema names as command arguments. The skill includes specific instructions for the agent to sanitize input by converting descriptions into kebab-case names, which reduces the risk of argument injection. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data by reading CLI output (JSON instructions and status) and existing project files (dependency artifacts) to generate new content.
- Ingestion points: Reads JSON output from
openspec instructionsandopenspec status, and reads markdown files from the project directory as context. - Boundary markers: Explicitly defines a "Planning boundary" that prohibits the agent from editing project code or starting implementation within this workflow.
- Capability inventory: Uses the
openspecCLI for metadata management and writes markdown files to the local file system. - Sanitization: Instructions require deriving kebab-case names from user descriptions to ensure consistent and safer file paths and identifiers.
Audit Metadata