openspec-archive-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill dynamically fetches external data from 'openspec instructions' CLI commands and instructs the agent to treat this data as behavioral contracts ('context' and 'operationGuidance'). This represents an ingestion point for potentially untrusted data that can influence agent decision-making. 1. Ingestion points: SKILL.md (Steps 1 and 4) executes shell commands to retrieve JSON-formatted instructions. 2. Boundary markers: The skill contains instructions to prioritize core command contracts and user choices over external guidance in case of conflict, providing a semantic safety layer. 3. Capability inventory: The skill utilizes the Bash(openspec:*) tool for shell execution, directory creation (mkdir), and file system operations (mv). 4. Sanitization: No explicit content sanitization is defined beyond the conflict resolution logic.
- [COMMAND_EXECUTION]: The skill performs multiple shell operations to manage the development workflow, including directory management and moving change roots to archive locations. While functional, these operations rely on variables and paths derived from CLI output and user input.
Audit Metadata