openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local configuration files and project artifacts which could theoretically contain malicious instructions designed to influence the agent's output.
- Ingestion points: The skill reads
<root.path>/openspec/config.yaml(orconfig.yml) and existing artifact files identified via theopenspec statuscommand (e.g.,design.md,spec.md,proposal.md). - Boundary markers: The instructions lack explicit XML-style delimiters or 'ignore embedded instructions' warnings for the ingested data, though they do instruct the agent to treat configuration as constraints rather than content to be reproduced.
- Capability inventory: The skill is scoped to the
openspecCLI tool viaBash(openspec:*)and has the capability to write new artifact files to the local filesystem atresolvedOutputPath. - Sanitization: No explicit sanitization or validation of the content read from the filesystem is described in the instructions.
Audit Metadata