openspec-archive-change
Warn
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs shell command execution in Step 5 (
mkdirandmv) using direct string interpolation of the<name>variable. If a change name contains shell metacharacters (e.g., semicolons, backticks, or pipes), it could lead to arbitrary command execution on the host system.- [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface in Step 3 by reading and parsingtasks.md. - Ingestion points: The agent reads the
tasks.mdfile from the local workspace. - Boundary markers: None identified; the skill does not use delimiters or instructions to ignore embedded content within the tasks file.
- Capability inventory: The skill has the ability to execute shell commands (
mkdir,mv) and invoke other tools (openspec-sync-specs). - Sanitization: There is no evidence of filtering or validation of the content read from the tasks file before processing.
Audit Metadata