openspec-archive-change
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands
mkdir -pandmvusing variables like<name>,<changeRoot>, and<planningHome.changesDir>. If the change name or path variables are maliciously crafted (e.g., containing shell metacharacters or directory traversal patterns), it could result in unauthorized file system modifications beyond the intended archive directory. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local files and CLI outputs, which could potentially contain instructions targeting the agent's logic during the archival process.
- Ingestion points: Reading
tasks.mdfor completion status and parsing the JSON output ofopenspec statusandopenspec list(SKILL.md). - Boundary markers: None identified. The instructions do not specify delimiters or warnings to ignore instructions within the task file or CLI output.
- Capability inventory: File system operations (
mkdir,mv) and execution of theopenspecCLI tool (SKILL.md). - Sanitization: There is no explicit instruction to sanitize the change name or paths extracted from the CLI output before interpolation into shell commands or prompts.
Audit Metadata