openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from codebase files like
openspec/config.yamland existing artifacts to ground its thinking, which provides a surface for indirect prompt injection.\n - Ingestion points: Reads configuration from
openspec/config.yamland project background fromcontextandrulesfields.\n - Boundary markers: No explicit markers or warnings are used when reading these files.\n
- Capability inventory: The skill can read any file in the project, search code, and execute
openspecCLI commands.\n - Sanitization: No sanitization is performed on the data ingested from the project files.\n- [COMMAND_EXECUTION]: The skill relies on the
openspecCLI tool to perform its primary tasks, constructing commands with arguments such as change names and store IDs that are derived from the user's current context.
Audit Metadata