openspec-continue-change
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using the
openspecCLI. User-provided or inferable data is interpolated into command strings (e.g.,openspec status --change "<name>" --json). This pattern creates a potential command injection surface if the agent does not strictly sanitize the<name>input before execution. - [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from shell commands to drive its internal logic, which introduces a vulnerability to indirect prompt injection from the contents of the OpenSpec artifacts.
- Ingestion points: Data is ingested through the output of
openspec list --jsonandopenspec status --change "<name>" --json(SKILL.md). - Boundary markers: The instructions do not define delimiters or provide specific warnings to the agent to disregard instructions embedded within the tool's output.
- Capability inventory: The skill has the ability to execute shell commands (
openspec) and write new files to the local file system (artifact creation loop). - Sanitization: There are no instructions for the agent to sanitize, validate, or escape the content returned by the CLI before using it to decide the next action.
Audit Metadata