openspec-verify-change
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
openspecCLI with various subcommands (list,status,instructions apply) to retrieve project state and artifact locations. This behavior is consistent with the skill's stated requirements and purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external change artifacts and the broader codebase, which constitutes a potential attack surface.
- Ingestion points: File contents retrieved from paths listed in
contextFiles(specifically tasks, specs, and design artifacts) and content found during codebase keyword searches. - Boundary markers: The instructions do not specify any delimiters or warnings to the agent to treat the artifact content strictly as data rather than instructions.
- Capability inventory: The agent is authorized to execute shell commands (
openspec), read local files, and perform codebase-wide searches. - Sanitization: No explicit sanitization, validation, or filtering of the artifact content is described before the agent processes it to extract requirements or scenarios.
Audit Metadata