openspec-plus-tasks
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions.
- Ingestion points: In Phase 1.1, the agent reads 'Proposal', 'Specs', and 'Design' files, as well as project-level instruction files like
AGENTS.mdandCLAUDE.md. - Boundary markers: Absent. The instructions do not define delimiters or explicit 'ignore instructions' wrappers for these ingested files, potentially allowing content within them to influence agent behavior.
- Capability inventory: The agent uses a local CLI tool (
openspec instructions tasks), writes to the filesystem (tasks.md), and dispatches a subagent (Agent(general-purpose)) using content derived from the untrusted inputs. - Sanitization: Absent. There is no mention of filtering, escaping, or validating the content of the ingested files before they are used to generate the task list or passed to the reviewer subagent.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a specific CLI command.
- Evidence: Phase 0 requires running
openspec instructions tasks --change <name> --jsonto extract structural templates and rules. While this is a vendor-specific tool, the execution of CLI commands based on user-supplied variables (<name>) represents a standard functional capability with an inherent command-injection surface if the variable is not handled safely by the underlying platform.
Audit Metadata