rhdh-spec-driven-schema
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
openspecCLI to fetch artifact instructions and status (e.g.,openspec instructions <id> --json). It also executes a local Python script,scripts/install_project_schema.py, to initialize the project directory by copying configuration files into anopenspec/folder. - [INDIRECT_PROMPT_INJECTION]: The skill reads existing project artifacts and CLI output to generate new documentation and implementation tasks. This creates a potential surface where malicious content in a project's documentation could attempt to influence the agent's behavior during subsequent turns.
- Ingestion points: The agent is instructed to read all files listed in the
dependenciesfield of the CLI response before drafting new artifacts (references/artifact-loop.md). - Boundary markers: The skill instructs the agent to treat
contextandrulesblocks as constraints rather than content, though it lacks explicit structural delimiters to separate untrusted document content from instructions. - Capability inventory: The skill performs file system writes to the product repository and has the ability to spawn subagents for implementation and verification phases (
schema.yaml). - Sanitization: The skill does not specify any sanitization, filtering, or escaping for the content ingested from the project's markdown files.
Audit Metadata