openspec-explore

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process codebase files and OpenSpec-specific artifacts, which constitutes an indirect prompt injection surface.
  • Ingestion points: Instructions direct the agent to read files, search code, and investigate the codebase, specifically targeting files like proposal.md, design.md, and spec.md within the openspec/changes/ directory.
  • Boundary markers: The instructions lack specific delimiters or system-level directives to isolate external file content or to ignore potential instructions embedded within the codebase data.
  • Capability inventory: The skill possesses the ability to read arbitrary codebase files, execute the openspec CLI tool, and write to various documentation and specification files.
  • Sanitization: There is no mention of sanitization, validation, or escaping of the content read from files before it is incorporated into the agent's context.
  • [COMMAND_EXECUTION]: The skill utilizes the openspec CLI tool to gather project context.
  • The command 'openspec list --json' is executed at the start of the session. This is a read-only operation and does not appear to incorporate unsanitized user input into the shell command string.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:49 PM
Security Audit — agent-trust-hub — openspec-explore