openspec-archive-change

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local shell commands (mkdir, mv) and the openspec CLI to manage the project's directory structure and archive changes.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from files and CLI outputs that could be influenced by third-party content.
  • Ingestion points: Reads tasks.md, spec files in openspec/changes/, and output from openspec list and openspec status.
  • Boundary markers: None observed in the instructions to distinguish file content from agent instructions.
  • Capability inventory: Includes file system modifications (mkdir, mv) and interaction with the openspec CLI.
  • Sanitization: No specific sanitization or validation of the content of tasks.md or spec files is described.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 11:39 PM