openspec-sync-specs
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the local CLI tool
openspec list --jsonto retrieve a list of available changes. This is a standard operation within the context of the tool's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from delta specification files located at
openspec/changes/<name>/specs/*/spec.mdand interpolates this content into the main specifications. - Ingestion points: Specification files at
openspec/changes/<name>/specs/*/spec.md(SKILL.md). - Boundary markers: The skill does not define explicit delimiters to separate the data read from the files from the agent's instructions, though it does look for specific Markdown headers (
## ADDED Requirements, etc.). - Capability inventory: The agent has the capability to read and write files within the
openspec/directory structure and execute theopenspecCLI tool. - Sanitization: There is no explicit sanitization or validation of the content being merged beyond the structural requirement for specific Markdown headers.
Audit Metadata