openspec-propose
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and follows instructions provided by the output of the
openspecCLI, which serves as a potential vector for data-driven instruction changes. Ingestion points: Data fromopenspec instructions(JSON) is used to guide artifact generation inSKILL.md. Boundary markers: The skill instructs the agent to treat thecontextandrulesfields as internal constraints and explicitly forbids copying them into the output artifacts. Capability inventory: The agent has the ability to write files to disk and execute variousopenspecCLI subcommands. Sanitization: The skill does not describe specific sanitization of the instruction text fetched from the CLI. - [DYNAMIC_EXECUTION]: The skill includes logic to dynamically invoke other commands or skills if directed by the
instructionfield from the CLI tool's output. - [COMMAND_EXECUTION]: The skill relies on executing
openspecCLI commands via bash to manage the change lifecycle, retrieve status, and obtain generation templates.
Audit Metadata