openspec-propose
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands via the
openspecCLI to scaffold changes and retrieve artifact templates. These operations are restricted to the tool's specific namespace. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided descriptions and tool-generated instructions to create artifacts. It implements a 'Planning boundary' guardrail that explicitly instructs the agent not to edit project code or begin implementation, mitigating the risk of instructions embedded in data influencing the agent to perform unauthorized actions.
- Ingestion points: User descriptions of changes, JSON output from
openspec instructions, and existing dependency files read from disk. - Boundary markers: Includes a prominent 'Planning boundary' section at the beginning of the instructions.
- Capability inventory: Ability to execute
openspeccommands and write markdown files to paths specified by the tool. - Sanitization: The agent is instructed to derive kebab-case identifiers from user input and follow specific templates provided by the tool.
Audit Metadata