openspec-verify-change
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the 'openspec' CLI tool via Bash to manage project stores, list changes, and retrieve instructions. These commands are integral to the skill's primary function of change verification.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and parses content from local project artifacts, including specifications, task lists, and design documents. This content is untrusted and could be manipulated to influence the agent's analysis or output.
- Ingestion points: Reads file paths provided by the
openspec instructions applycommand, specifically targeting files associated withcontextFiles.tasks,contextFiles.specs, andcontextFiles.design(e.g., SKILL.md). - Boundary markers: There are no explicit delimiters or instructions defined to isolate the content of these artifacts from the agent's logical processing, increasing the risk that embedded text could be interpreted as instructions.
- Capability inventory: The agent has the ability to execute 'openspec' CLI commands, search the local codebase using keywords, and read arbitrary files identified as artifacts.
- Sanitization: The skill does not implement sanitization, filtering, or validation of the ingested markdown content before performing its logic, such as extracting requirements or checking task checkboxes.
Audit Metadata