openspec-explore
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external project files, including
proposal.md,design.md,tasks.md, and specification files. Because these files are read into the agent's context to guide the conversation, they represent an attack surface where malicious instructions could be embedded. - Ingestion points: Reads files from
openspec/changes/<name>/andspecs/directories. - Boundary markers: No specific delimiters or instructions to ignore embedded commands are provided in the skill for these read operations.
- Capability inventory: The skill utilizes shell command execution (
openspec list --json) and file system read access. - Sanitization: No sanitization or validation of the content of the read files is performed before interpolation into the prompt.
- [COMMAND_EXECUTION]: The skill utilizes the
openspec list --jsoncommand to programmatically list active project changes. This execution is limited to a fixed command and is used exclusively for gathering context within the intended OpenSpec environment.
Audit Metadata