openspec-onboard
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
openspecCLI and standardgitcommands to manage the development workflow, such as creating changes, checking status, and viewing history. These operations are scoped to the project directory and are consistent with the skill's purpose.- [PROMPT_INJECTION]: The skill scans the local codebase for specific string patterns (e.g., TODO, FIXME, HACK) to identify improvement opportunities. This creates an indirect prompt injection surface where untrusted data (code comments) is brought into the agent's context and used to generate task suggestions. - Ingestion points: Phase 2 of
SKILL.mdscans the codebase for comments and git history. - Boundary markers: The instructions do not define clear boundaries or 'ignore' instructions for the content found in these comments.
- Capability inventory: The skill can modify the codebase by writing files and executing tasks defined during the planning phase.
- Sanitization: There is no evidence of sanitization or filtering of the content extracted from the codebase before it is presented as a task suggestion.
Audit Metadata