openspec-new-change
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local commands using the 'openspec' CLI tool, specifically calling
openspec new change,openspec status, andopenspec instructions. These operations are central to the skill's intended purpose and are restricted to the 'openspec/' directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input to define new features or modifications.
- Ingestion points: Step 1 uses
AskUserQuestionto ingest a description of the change from the user. - Boundary markers: None present; the input is directly used to derive context.
- Capability inventory: The skill has the capability to execute shell commands (
openspecCLI) and read status information. - Sanitization: The skill instructions include a guardrail to 'derive a kebab-case name' and validate that the name is valid kebab-case before proceeding, which provides partial mitigation against command injection but does not fully eliminate the risk of the agent being influenced by malicious instructions embedded in the feature description.
Audit Metadata