openspec-verify-change
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the local codebase and specification files which acts as an attack surface for indirect prompt injection.
- Ingestion points: In SKILL.md, steps 3, 4, and 5 involve reading file paths returned by the openspec CLI and searching the codebase for implementation evidence.
- Boundary markers: The instructions do not define delimiters or specific markers to isolate processed file content from the agent's instructions.
- Capability inventory: The agent uses the openspec CLI to interact with change artifacts and has read access to the local filesystem.
- Sanitization: There is no explicit sanitization of the content extracted from the codebase or artifact files is mentioned.
- [COMMAND_EXECUTION]: The skill invokes the openspec CLI to perform its primary function of auditing changes.
- Evidence: Steps 1, 2, and 3 in SKILL.md detail the execution of openspec list, openspec status, and openspec instructions apply to gather change metadata and artifact locations.
Audit Metadata