openspec-workflow
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions guide the user to install the
@fission-ai/openspecpackage via the npm registry to enable enhanced features like validation and dashboards. - [COMMAND_EXECUTION]: The agent is authorized to perform file system operations such as creating directories (
mkdir) and moving files (mv) within the project'sopenspec/directory. It also executes theopenspecCLI to perform spec validation and archiving. - [PROMPT_INJECTION]: The skill implements a workflow that involves reading and processing specification files (e.g.,
proposal.md,spec.md). While this represents a surface for indirect prompt injection, the skill mitigates risk by requiring explicit human alignment and approval at every stage before code implementation begins.
Audit Metadata