openspec-sync-specs
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs local file operations within the
openspec/project directory, specifically reading delta specs and writing to main specification files. These actions are limited to the skill's documented purpose. - [SAFE]: Local command execution is limited to
openspec list --json, which is an expected use of the project's own CLI tool for listing changes. - [SAFE]: No network operations, external downloads, or data exfiltration attempts were detected. The skill operates entirely on local project data.
- [SAFE]: No obfuscation, hidden instructions, or credential exposure issues were found in the skill metadata or instructions.
- [SAFE]: While the skill processes external data (delta specs), it is not vulnerable to significant indirect prompt injection because its actions are limited to text manipulation within Markdown files and do not involve executing untrusted code or exfiltrating data.
Audit Metadata