openspec-schema-authoring
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
openspecCLI to perform repository-local tasks such as initializing, forking, and validating schemas. These commands are standard for the tool's intended purpose and do not involve elevated privileges or suspicious network activity. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to interpolate user-provided values, such as schema names and descriptions, directly into shell commands (e.g.,
openspec schema init <schema-name>). This creates a surface for command injection if the user provides malicious input. - Ingestion points: User-supplied
<schema-name>,<source>, and description text are used as CLI arguments. - Boundary markers: No specific delimiters or validation patterns are provided in the instructions to sanitize these inputs before execution.
- Capability inventory: The skill allows file creation, directory modification, and execution of the
openspecbinary. - Sanitization: The skill does not explicitly perform sanitization, relying on the platform's tool execution environment to handle shell escaping.
Audit Metadata