openspec-continue-change

Pass

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill frequently executes shell commands (e.g., openspec status --change "<name>") that interpolate variables such as <name> and <artifact-id>. While these variables are enclosed in double quotes, they represent potential command injection points if the user-supplied input is not properly sanitized by the underlying execution environment.
  • [PROMPT_INJECTION]: The skill processes external data that could lead to indirect prompt injection. It reads instructions, context, and rules from the output of the openspec CLI to determine what content to generate.
  • Ingestion points: Instructions and constraints are ingested via the openspec instructions command in SKILL.md.
  • Boundary markers: The skill includes a specific 'Guardrails' section that warns the agent to treat context and rules as internal constraints and explicitly forbids copying them into the output files.
  • Capability inventory: The skill has the capability to execute shell commands (openspec), read local files (dependency artifacts), and write files to arbitrary paths provided by the CLI (outputPath).
  • Sanitization: There is no evidence of automated sanitization or validation of the content provided by the CLI before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 3, 2026, 03:11 PM
Security Audit — agent-trust-hub — openspec-continue-change