openspec-explore
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process codebase files and OpenSpec-specific artifacts, which constitutes an indirect prompt injection surface.
- Ingestion points: Instructions direct the agent to read files, search code, and investigate the codebase, specifically targeting files like proposal.md, design.md, and spec.md within the openspec/changes/ directory.
- Boundary markers: The instructions lack specific delimiters or system-level directives to isolate external file content or to ignore potential instructions embedded within the codebase data.
- Capability inventory: The skill possesses the ability to read arbitrary codebase files, execute the openspec CLI tool, and write to various documentation and specification files.
- Sanitization: There is no mention of sanitization, validation, or escaping of the content read from files before it is incorporated into the agent's context.
- [COMMAND_EXECUTION]: The skill utilizes the openspec CLI tool to gather project context.
- The command 'openspec list --json' is executed at the start of the session. This is a read-only operation and does not appear to incorporate unsanitized user input into the shell command string.
Audit Metadata