openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local filesystem and CLI tool outputs, representing a standard indirect prompt injection surface for agents that interact with codebases.\n
- Ingestion points: The skill reads project configuration files (openspec/config.yaml or config.yml), existing artifact files (spec.md, design.md, proposal.md, tasks.md), and JSON output from the
openspecCLI tool.\n - Boundary markers: The instructions explicitly direct the agent to ground its thinking in the project context and rules without copying them into the artifacts or the conversation.\n
- Capability inventory: The skill uses a restricted set of bash commands via the
openspectool (as scoped in the YAML frontmatter) and reads local project files to assist in the exploration and capturing of ideas.\n - Sanitization: The skill processes structured JSON output from the CLI and uses the agent's internal logic to evaluate conditions and instructions before writing to artifacts.
Audit Metadata