openspec-propose
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes JSON data returned by the
openspec instructionscommand, including background context, rules, and templates, which are interpolated into the agent's context to generate artifact files. This represents an indirect prompt injection surface where a compromised or malicious CLI configuration could influence agent behavior. - Ingestion points: Data returned from
openspec status --jsonandopenspec instructions <artifact-id> --json(SKILL.md, steps 3 and 4). - Boundary markers: Absent. The instructions do not define clear delimiters to separate the ingested instructions/context from the agent's primary safety guidelines.
- Capability inventory: File system write access to
resolvedOutputPathand execution of theopenspeccommand-line tool. - Sanitization: None detected; the skill directly uses the string content from the JSON fields to structure its output.
Audit Metadata