openspec-update-change
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes data from external planning artifacts and CLI outputs, creating a surface for indirect prompt injection.
- Ingestion points: Data enters the agent context through the reading of project files listed in existingOutputPaths and the JSON output of openspec commands in SKILL.md.
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the content being read from the file system.
- Capability inventory: The skill is authorized to use the openspec CLI via Bash and can modify existing planning files on the local file system.
- Sanitization: No sanitization, escaping, or validation of the ingested artifact content is performed before the agent reconciles or revises the documents.
Audit Metadata