openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests project-specific configuration and documentation artifacts, creating a surface where instructions embedded in those files could influence agent behavior.
- Ingestion points: Project configuration (
openspec/config.yaml), existing artifacts (designs, proposals, specs), and the general codebase. - Boundary markers: The skill explicitly instructs the agent to treat external rules/context as constraints and not to reproduce them in output.
- Capability inventory: The agent can read files and execute
openspecCLI commands to create documentation, but it is explicitly forbidden from implementing features or writing application code. - Sanitization: Relies on instructional boundaries to prevent the leakage of instructions found in ingested data.
- [COMMAND_EXECUTION]: The skill uses a dedicated CLI tool (
openspec) via bash to manage project state, list changes, and generate documentation templates. These operations are scoped to the tool's specific functionality.
Audit Metadata