openspec-bulk-archive-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its ingestion of untrusted data from delta specs and the codebase (SKILL.md). 1. Ingestion points: The skill reads JSON from openspec list and status commands and crawls the codebase for implementation evidence. 2. Boundary markers: None present to delimit external content or warn the agent to ignore embedded instructions. 3. Capability inventory: The agent uses the Bash tool for mkdir and mv operations and searching the codebase. 4. Sanitization: No sanitization of ingested content is specified. An attacker could embed instructions in specs or source code to manipulate the archiving process or logic.
- [COMMAND_EXECUTION]: Step 8 of the skill executes shell commands like mkdir and mv using parameters name and changeRoot obtained from the openspec CLI output. If these external identifiers are not strictly validated or sanitized by the platform, they could be leveraged for path traversal or command injection if they contain malicious characters.
Audit Metadata