openspec-continue-change
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill frequently executes shell commands (e.g.,
openspec status --change "<name>") that interpolate variables such as<name>and<artifact-id>. While these variables are enclosed in double quotes, they represent potential command injection points if the user-supplied input is not properly sanitized by the underlying execution environment. - [PROMPT_INJECTION]: The skill processes external data that could lead to indirect prompt injection. It reads instructions, context, and rules from the output of the
openspecCLI to determine what content to generate. - Ingestion points: Instructions and constraints are ingested via the
openspec instructionscommand inSKILL.md. - Boundary markers: The skill includes a specific 'Guardrails' section that warns the agent to treat
contextandrulesas internal constraints and explicitly forbids copying them into the output files. - Capability inventory: The skill has the capability to execute shell commands (
openspec), read local files (dependency artifacts), and write files to arbitrary paths provided by the CLI (outputPath). - Sanitization: There is no evidence of automated sanitization or validation of the content provided by the CLI before it is processed by the agent.
Audit Metadata