openspec-new-change

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • Command Execution: The skill executes several commands using the npx openspec utility to scaffold new project changes, check their status, and retrieve instructions. This is the primary mechanism for the skill's functionality within the OpenSpec ecosystem.
  • External Package Usage: The skill relies on the openspec package, which is executed via npx. This may involve downloading the package from the NPM registry if it is not already available in the execution environment.
  • Input Validation Surface: The skill accepts user-provided descriptions and names to initialize project directories. It incorporates a security guardrail that requires project names to follow a strict kebab-case format, which serves as a mitigation against potential command injection by limiting the character set allowed in shell arguments.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 09:55 PM