openspec-archive-change
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses 'openspec instructions archive' and 'openspec instructions specs' to fetch dynamic context and guidance that the agent is then directed to follow as 'behavior contracts'. This creates a surface for indirect prompt injection where instructions embedded in external data could influence or override intended behavior.
- Ingestion points: 'openspec instructions archive --change "" --json' and 'openspec instructions specs --change "" --json' (SKILL.md).
- Boundary markers: The instructions specify that these fields should be kept separate from built-in steps and that conflicts must be reported.
- Capability inventory: The skill uses the 'Bash' tool for command execution and file system operations such as 'mkdir' and 'mv'.
- Sanitization: The agent is explicitly instructed not to copy the guidance text verbatim into outputs and to explain any inapplicable advice.
- [COMMAND_EXECUTION]: The skill constructs shell commands by interpolating variables like 'change_name' and 'store_id' into bash strings. If these variables, which can be derived from project metadata or CLI outputs, contain malicious shell metacharacters, they could facilitate command injection attacks.
Audit Metadata