openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze arbitrary content from the local codebase and configuration files, creating an attack surface where malicious instructions embedded in those files could influence the agent's reasoning.
- Ingestion points: Local codebase files and
openspec/config.yamlorconfig.ymlconfiguration files accessed during discovery. - Boundary markers: The skill instructions lack explicit delimiters or "ignore embedded instructions" warnings to separate untrusted codebase content from the agent's internal reasoning instructions.
- Capability inventory: The skill uses the
openspecCLI to manage change status, read specifications, and generate new design artifacts via restricted bash commands. - Sanitization: There is no explicit requirement for the agent to sanitize or filter content read from project files before processing it.
Audit Metadata