openspec-ff-change
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the
openspecCLI tool to perform several operations: creating new changes (openspec new change), checking status (openspec status), and fetching instructions for specific artifacts (openspec instructions). These commands are central to the skill's intended functionality for project scaffolding. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the output of the
openspec instructionscommand, which includes context, rules, and templates that dictate how the agent creates artifact files. - Ingestion points: Step 4a retrieves JSON data from the
openspec instructionscommand. - Boundary markers: The instructions do not specify any boundary markers or delimiters to separate the ingested instructions from the agent's core logic.
- Capability inventory: The skill has the capability to execute shell commands via the
openspecCLI and write files to the local file system. - Sanitization: There is no mention of sanitizing or validating the
template,context, orinstructionfields provided by the external tool before the agent acts on them.
Audit Metadata