openspec-propose
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands using the openspec CLI, such as 'new change', 'status', and 'instructions'. The arguments for these commands, including change names and store IDs, are derived from user input or project-specific configurations, which presents a potential surface for command injection if the input is not strictly validated.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which could lead to indirect prompt injection.
- Ingestion points: Data is ingested from the JSON output of CLI commands (openspec status, openspec instructions) and from the content of previously completed artifact files (SKILL.md, Step 4a).
- Boundary markers: The instructions lack specific boundary markers or 'ignore' directives to separate the ingested data from the agent's internal instructions.
- Capability inventory: The skill has the capability to execute shell commands and write files to the project directory.
- Sanitization: There are no documented steps for sanitizing or validating the content retrieved from CLI outputs or dependency artifacts before it is used to generate subsequent content.
Audit Metadata