openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files (e.g.,
config.yaml, codebase files) to establish context for its thinking process, creating a potential surface for indirect prompt injection. - Ingestion points: Processes content from
<root.path>/openspec/config.yamland reads files from the local codebase to map architecture. - Boundary markers: Includes explicit instructions to treat external data as constraints only and strictly forbids copying the content into responses or artifacts.
- Capability inventory: Shell command execution is strictly limited to the
openspecCLI via theallowed-toolsfrontmatter configuration. - Sanitization: Relies on instructional boundaries to prevent the agent from obeying instructions embedded in analyzed data.
Audit Metadata