openspec-verify-change
Warn
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill constructs shell commands by interpolating a user-supplied or context-derived variable
<name>into theopenspecCLI call. \n - Evidence:
openspec status --change "<name>" --jsonandopenspec instructions apply --change "<name>" --json. \n - Risk: If the input variable is not properly sanitized for shell metacharacters (e.g.,
;,&,|) or contains unbalanced quotes, it may allow for command injection, leading to unauthorized operations on the host system.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from markdown artifacts (specs, tasks, design) to guide its verification and search processes, making it vulnerable to embedded instructions that could manipulate the report outcome.\n - Ingestion points: Reads artifact files specified in
contextFilesand files withinopenspec/changes/<name>/specs/.\n - Boundary markers: None. The agent is not instructed to use delimiters or ignore instructions within the ingested data.\n
- Capability inventory: Shell command execution via the
openspecCLI and broad read access to the local codebase for verification searches.\n - Sanitization: None. The skill parses and acts upon requirement text and scenario descriptions directly without validation.
Audit Metadata