openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data from the codebase, creating a surface for potential indirect prompt injection.
- Ingestion points: The agent reads the
openspec/config.yamlfile and existing OpenSpec artifacts (specs, designs, proposals) to gain project context. - Boundary markers: The instructions explicitly direct the agent to treat this data as constraints rather than content to reproduce, and it is strictly forbidden from copying external context into new artifacts or the conversation.
- Capability inventory: The skill uses the
openspecCLI to manage design artifacts and list project status, but it is explicitly barred from writing application code. - Sanitization: While no specific sanitization is mentioned, the skill limits the agent's actions to thinking and documentation within a restricted toolset.
- [COMMAND_EXECUTION]: The skill interacts with the user's environment via the
openspecCLI to manage change proposals and project configuration. These commands are necessary for the skill's function and are limited to the specific operations defined by the OpenSpec tool.
Audit Metadata