Skills
Navigate
skills/intent-driven-dev/intent-driven-template/openspec-new-change/Gen Agent Trust Hub

openspec-new-change

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill interacts with the local environment using the openspec CLI to perform operations such as listing stores, checking project status, and creating new change directories. These operations are restricted to the openspec toolset via the allowed-tools configuration.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided descriptions to generate identifiers for shell commands. It explicitly instructs the agent to derive and validate these identifiers as kebab-case strings, providing a sanitization layer against command injection or unintended shell behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 02:17 PM