openspec-bulk-archive-change
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands including
mkdir -pandmvusing variables likeplanningHome.changesDirandchangeRootderived fromopenspec status --json. While these are expected for the skill's archival functionality, they rely on the integrity of the external tool's output to avoid targeting sensitive system directories. - [INDIRECT_PROMPT_INJECTION]: The skill reads implementation evidence from the codebase and delta specification files to resolve conflicts between changes. This ingestion of untrusted content represents an attack surface where malicious code comments or documentation could influence the agent's logic.
- Ingestion points: Codebase search results, delta specification files (
artifactPaths.specs.existingOutputPaths), andopenspecCLI JSON output (SKILL.md). - Boundary markers: No explicit markers or delimiters are defined to isolate the ingested codebase or spec content from the agent's core instructions.
- Capability inventory: File system operations (
mkdir,mv) and automated spec synchronization/merging. - Sanitization: The skill does not specify any sanitization, filtering, or validation of codebase content before it is processed by the agent for decision-making.
Audit Metadata