openspec-sync-specs
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests content from external specification files and uses an LLM-driven "intelligent merging" process to update main specification files.
- Ingestion points: The agent reads data from
openspec/changes/<name>/specs/*/spec.mdandopenspec/specs/<capability>/spec.md(SKILL.md). - Boundary markers: Absent. There are no explicit delimiters or instructions to treat the file content as untrusted data separate from the agent's core logic.
- Capability inventory: The skill has the ability to read and write to the local file system and execute shell commands via the
openspecCLI. - Sanitization: Absent. The skill relies on the agent's "judgment" to merge content, which can be manipulated by instructions embedded within the files being processed.
- [COMMAND_EXECUTION]: The skill relies on the
openspecCLI tool to function. - Evidence: The instructions require running
openspec list --jsonto select changes (SKILL.md).
Audit Metadata