openspec-propose
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
openspecCLI to perform operations such as creating new change scaffolds (openspec new change), checking status (openspec status), and retrieving artifact generation guidance (openspec instructions). These commands are local and central to the skill's documented purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data including user-provided descriptions and JSON output from the CLI to populate artifact templates. This creates a surface for indirect prompt injection where malicious instructions could theoretically be embedded in the source data.
- Ingestion points: User input descriptions and the
instruction,context, andrulesfields from theopenspec instructionsJSON output. - Boundary markers: Uses structured output templates and defined schemas to constrain the generated content.
- Capability inventory: Includes the ability to write to the file system (via
TodoWrite) and execute shell commands (via theopenspecCLI). - Sanitization: Relies on structured parsing of JSON input and the application of technical writing style rules (ASD-STE100) to the output prose.
Audit Metadata