openspec-archive-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and follow instructions from external sources via
openspec instructions archiveandopenspec instructions specs. - Ingestion points: JSON output from
openspec instructionscommands in Step 1 and Step 4 (SKILL.md). - Boundary markers: The skill includes instructions to ignore guidance that conflicts with controlling inputs, resolved paths, or command contracts, and notes that guidance is advisory.
- Capability inventory: The agent has access to
Bash(openspec toolset), file system operations (mkdir,mv), and triggers for other synchronization workflows. - Sanitization: No explicit sanitization or validation of the external instruction content is described beyond basic JSON parsing and logical conflict checks.
- [COMMAND_EXECUTION]: The skill executes multiple shell commands including
mkdir,mv, and variousopenspecCLI calls using variables like<name>,<id>, and<target-name>. - While these variables are wrapped in double quotes in the skill's instructions, they represent a potential surface for command injection if the agent does not properly sanitize inputs derived from user conversation or external command outputs before execution.
Audit Metadata