openspec-sync-specs
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data that could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Reads delta specification files from
openspec/changes/<name>/specs/and 'actual code' from affected repositories to identify implementation status. - Boundary markers: The skill does not define clear delimiters (e.g., XML tags or specific 'ignore' instructions) when reading these external files before integrating their content.
- Capability inventory: The agent has permissions to read/write local files and execute the
openspecCLI tool. - Sanitization: There is no evidence of filtering or escaping logic applied to the content read from delta specs or source code before it is processed by the LLM for 'intelligent merging'.
- [COMMAND_EXECUTION]: The skill executes a local command-line interface tool as part of its standard workflow.
- Evidence: The instruction in Step 1 explicitly directs the agent to run
openspec list --jsonto retrieve project metadata. While this is an expected use of theopenspecCLI, it constitutes a shell interaction.
Audit Metadata