openspec-archive-change
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes data from local files and CLI tool outputs, representing an indirect prompt injection surface.\n
- Ingestion points: Reads content from
tasks.mdand parses JSON output fromopenspec listandopenspec status(SKILL.md).\n - Boundary markers: The instructions do not use delimiters to wrap external content or provide directives to ignore potentially malicious instructions within that content.\n
- Capability inventory: The skill can execute file system commands (
mkdir,mv) and trigger additional agent skills using the Task tool.\n - Sanitization: There is no evidence of sanitization or validation of the data retrieved from external files or tool outputs before it is used to drive logic.\n- [COMMAND_EXECUTION]: The skill executes shell commands using variables derived from the output of the
openspecCLI.\n - Evidence: The commands
mkdirandmvuse variables like<planningHome.changesDir>and<changeRoot>which are obtained fromopenspec status --json(SKILL.md).
Audit Metadata