openspec-sync-specs
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various
openspecCLI commands via a Bash tool, incorporating user-provided variables such as change names and store IDs. While the instructions suggest using quotes around these variables (e.g.,openspec status --change "<name>"), this pattern presents a potential command injection surface if the underlying agent fails to properly sanitize or escape user input before shell execution. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading and intelligently merging content from 'delta specs' (markdown files) into 'main specs'. Because the agent must interpret the semantic meaning of these files to perform the merge, malicious instructions embedded within a delta spec could potentially influence the agent's logic.
- Ingestion points: The agent reads the content of delta spec files in Step 4a and main spec files in Step 4b.
- Boundary markers: There are no explicit instructions or delimiters provided to the agent to distinguish between specification data and potential instructions embedded within that data.
- Capability inventory: The skill allows the agent to write/edit files in the
specs/directory and executeopenspecCLI commands. - Sanitization: No sanitization or filtering of the markdown content is performed before the agent processes it for merging.
Audit Metadata