openspec-generate-specs
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources which could contain malicious instructions designed to influence the agent's behavior during the specification generation process. Ingestion points: Reads project files (e.g., AGENTS.md, src/ modules, docs/) and fetches external data from GitHub issues and pull requests via MCP tools. Boundary markers: The instructions lack explicit delimiters or 'ignore embedded instructions' warnings for the content being analyzed. Capability inventory: The agent can create directories, write markdown files to openspec/specs/, and execute the openspec validate command. Sanitization: There is no evidence of sanitization, escaping, or validation of the external content before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill executes local shell commands to validate the generated specifications. Evidence: Step 6 involves running 'openspec validate --specs --json' to check the validity of the output. While this is a standard operational step for the tool's purpose, it represents a capability that could be targeted if the agent's logic is influenced by malicious data.
Audit Metadata