openspec-continue-change
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill integrates with the openspec command-line interface to manage development workflows. It executes shell commands including
openspec list,openspec status, andopenspec instructionsto retrieve project state and instructions. This relies on the openspec CLI being available in the execution environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources and project files to generate new content, which represents a surface for potential indirect prompt injection attacks.
- Ingestion points: The skill reads project background and instructions from the JSON output of the
openspec instructionscommand and reads content from specifieddependenciesfiles within the workspace. - Boundary markers: The instructions do not specify the use of delimiters (such as XML tags or triple quotes) or explicit "ignore embedded instructions" warnings for the content read from external files.
- Capability inventory: The agent has the ability to read from the local file system, write files to user-defined paths (
outputPath), and execute shell commands via the openspec CLI. - Sanitization: There are no mechanisms described for sanitizing, validating, or escaping the content ingested from dependency files before it is processed by the AI to create new artifacts.
Audit Metadata