openspec-archive-change

Warn

Audited by Gen Agent Trust Hub on Jul 12, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs shell command execution in Step 5 (mkdir and mv) using direct string interpolation of the <name> variable. If a change name contains shell metacharacters (e.g., semicolons, backticks, or pipes), it could lead to arbitrary command execution on the host system.- [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface in Step 3 by reading and parsing tasks.md.
  • Ingestion points: The agent reads the tasks.md file from the local workspace.
  • Boundary markers: None identified; the skill does not use delimiters or instructions to ignore embedded content within the tasks file.
  • Capability inventory: The skill has the ability to execute shell commands (mkdir, mv) and invoke other tools (openspec-sync-specs).
  • Sanitization: There is no evidence of filtering or validation of the content read from the tasks file before processing.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 12, 2026, 11:12 AM
Security Audit — agent-trust-hub — openspec-archive-change