openspec-sync-specs

Pass

Audited by Gen Agent Trust Hub on Aug 31, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests content from external specification files and uses an LLM-driven "intelligent merging" process to update main specification files.
  • Ingestion points: The agent reads data from openspec/changes/<name>/specs/*/spec.md and openspec/specs/<capability>/spec.md (SKILL.md).
  • Boundary markers: Absent. There are no explicit delimiters or instructions to treat the file content as untrusted data separate from the agent's core logic.
  • Capability inventory: The skill has the ability to read and write to the local file system and execute shell commands via the openspec CLI.
  • Sanitization: Absent. The skill relies on the agent's "judgment" to merge content, which can be manipulated by instructions embedded within the files being processed.
  • [COMMAND_EXECUTION]: The skill relies on the openspec CLI tool to function.
  • Evidence: The instructions require running openspec list --json to select changes (SKILL.md).
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 31, 2026, 08:19 PM
Security Audit — agent-trust-hub — openspec-sync-specs