openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external codebase data and project-specific markdown files, creating an attack surface where malicious content in those files could influence agent behavior.\n
- Ingestion points: The skill reads arbitrary files from the user's codebase and specifically searches for artifacts in the
openspec/changes/directory.\n - Boundary markers: The instructions do not specify any delimiters or explicit warnings to isolate ingested file content from the agent's internal logic.\n
- Capability inventory: The agent has the ability to write/modify markdown artifacts (proposals, designs, specs) and execute the
openspecCLI command.\n - Sanitization: There are no specified procedures for sanitizing, validating, or filtering data ingested from external files.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
openspec list --jsoncommand to gather project context. This is a local command associated with theopenspecCLI, which is a declared dependency of the skill author.
Audit Metadata