openspec-new-change
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill executes several commands using the
npx openspecutility to scaffold new project changes, check their status, and retrieve instructions. This is the primary mechanism for the skill's functionality within the OpenSpec ecosystem. - External Package Usage: The skill relies on the
openspecpackage, which is executed vianpx. This may involve downloading the package from the NPM registry if it is not already available in the execution environment. - Input Validation Surface: The skill accepts user-provided descriptions and names to initialize project directories. It incorporates a security guardrail that requires project names to follow a strict kebab-case format, which serves as a mitigation against potential command injection by limiting the character set allowed in shell arguments.
Audit Metadata