openspec-archive-change
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources including
openspecCLI outputs and a localtasks.mdfile. - Ingestion points: Reads
openspec list --json(Step 1),openspec status --json(Step 2),tasks.md(Step 3), and delta specifications atopenspec/changes/<name>/specs/(Step 4). - Boundary markers: The instructions do not define clear delimiters or use 'ignore embedded instructions' warnings when processing this content.
- Capability inventory: The skill can create directories (
mkdir), move files (mv), and invoke other agent skills via the Task tool. - Sanitization: There is no explicit sanitization or validation of the content read from
tasks.mdor the delta specs before they are summarized or passed to sub-agents. - [COMMAND_EXECUTION]: The skill executes shell commands for file system operations.
- Evidence: Uses
mkdir -p openspec/changes/archiveandmv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>. While these are standard for archiving, the<name>variable is derived from tool output or user selection.
Audit Metadata