openspec-sync-specs
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
openspec list --jsoncommand. This is documented as a requirement for the skill's operation and aligns with the tool's purpose of managing specifications as indicated by the author name. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection via the contents of delta specification files processed at runtime.
- Ingestion points: The agent reads data from
openspec/changes/<name>/specs/*/spec.mdto determine what changes to apply to the main specs. - Boundary markers: No explicit markers are defined to separate the data in the spec files from instructions to the agent, which increases the risk that data could be misinterpreted as commands.
- Capability inventory: The agent has the capability to modify files in the local filesystem (
openspec/specs/) and execute theopenspecCLI tool. - Sanitization: The instructions explicitly tell the agent to use its 'judgment' and interpret the 'intent' of the delta specs, which can be exploited if those files contain embedded instructions disguised as specification data.
Audit Metadata