openspec-verify-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data to drive its verification logic, which creates a potential surface for indirect prompt injection.
- Ingestion points: The skill reads contents from files specified in
contextFiles(typicallytasks.md,specs.md, anddesign.md) identified via theopenspec instructions applycommand. - Boundary markers: The skill does not implement explicit boundary markers or "ignore embedded instructions" warnings when processing the requirements and design decisions extracted from these files.
- Capability inventory: The skill uses the
Bash(openspec:*)tool to interact with the local repository and assumes capabilities to search the codebase for keywords and implementation evidence. - Sanitization: There is no evidence of sanitization or filtering of the content read from the markdown artifacts before it is used to influence the agent's verification report and search queries.
Audit Metadata