Security audit

OpenSpec Workflow

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent OpenSpec automation workflow, but it asks agents and CI to make repository changes with unusually broad authority and weak guardrails.

Install only if you are comfortable with an autonomous workflow that can read and modify the whole repo, commit, push, open PRs, and run a persistent archive action. Before use, remove `--dangerously-skip-permissions`, pin dependencies/actions, replace `git add -A` with path allowlists, require clean worktrees and human review before commits or pushes, and make branch deletion opt-in and same-repository only.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:110
Finding: Claude Code Executes Repository-Controlled Instructions Without Permission Checks
Content: View full analysis
/tasks.md ``` Launch Claude Code in the repo (or worktree) with PTY and `--dangerously-skip-permissions`: ```bash exec pty:true workdir: background:true command:"claude --dangerously-skip-permissions -p 'Implement these tasks from openspec/changes//tasks.md. Read the tasks file, the proposal, design, and specs in that change directory for full context. Mark tasks complete as you go. Commit when done. When completely finished, run: openclaw system event --text \"Done: implemented \" --mode now'" ``` `references/review-loop.md:20-36`: ```bash exec pty:true workdir: background:true command:"claude --dangerously-skip-permissions -p 'You are a skeptical spec reviewer. Your job is to challenge this [ARTIFACT TYPE] and find weaknesses. ## Your Job 1. Read the change artifacts: openspec/changes/[CHANGE_NAME]/ 2. Read the existing specs: openspec/specs/[RELEVANT_SPEC]/spec.md 3. Explore the codebase — grep for patterns, read files that will be affected, verify claims 4. Then challenge. Based on what you actually found: - [2-4 specific questions relevant to this artifact type] ## [ARTIFACT TYPE] to Review [Paste the full artifact content] Rules: - State APPROVED if satisfied - Otherwise, list 2-5 specific challenges (not nitpicks) - For each challenge, cite what you found in the code and suggest an alternative - Be direct When finished, run: openclaw system event --text \"Review complete: [APPROVED or NOT APPROVED with summary]\" --mode now'" ``` ### Technical Analysis The `--dangerously-skip-permissions` option disables Claude Code's normal approval boundary for tool use. The invoked agent is inst ...[truncated 1989 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/archive-action.md:37
Finding: Unpinned Third-Party Components Execute with Repository Write Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/archive-action.md:82
Finding: Broad Git Staging Can Commit and Transmit Unrelated Sensitive Files
Content: View full analysis
(scope): (#) OpenSpec change: $CHANGE" git push origin ``` `SKILL.md:169-170`: ```bash git add -A && git commit -m "fix: address review — " git push origin ``` `references/archive-action.md:82-99`: ```yaml env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | CHANGE="${{ steps.extract.outputs.change }}" BRANCH="openspec/archive-${CHANGE}" git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" git checkout -b "$BRANCH" git add -A git diff --cached --quiet && echo "Nothing to commit" && exit 0 git commit -m "chore(openspec): archive and sync ${CHANGE}" git push origin "$BRANCH" gh pr create \ --base main \ --head "$BRANCH" \ --title "chore(openspec): archive ${CHANGE}" \ --body "Auto-generated by OpenSpec Archive workflow. Syncs delta specs into main specs and moves \`openspec/changes/${CHANGE}\` to archive. Source PR: #${{ github.event.pull_request.number }}" ``` ### Technical Analysis `git add -A` stages all modifications, deletions, and untracked files throughout the working tree. The commands do not restrict staging to the OpenSpec archive paths or files associated with the approved implementation. The staged content is subsequently committed and pushed to GitHub. If an agent, build process, tool, or user leaves an unrelated sensitive file in the worktree, broad staging may publish it. The workflow only checks whether the staged diff is empty; it does not inspect the paths or content. The use of authenticated `git push` and `gh pr create` is necessary for the declared publishing functionality. The ...[truncated 1110 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/archive-action.md:103
Finding: Fork Branch-Name Confusion Can Delete an Unrelated Target-Repository Branch
Content: View full analysis
/dev/null || echo "Branch already deleted or protected" ``` ### Technical Analysis For a pull request originating from a fork, `github.event.pull_request.head.ref` identifies only the source branch name. It does not identify the repository that owns that branch. The workflow's `origin` is the target repository checked out earlier in the job. Consequently, deleting `head.ref` from `origin` can target an unrelated branch with the same name in the target repository rather than the actual fork branch. The cleanup condition only checks whether an OpenSpec marker was extracted. It does not require successful change-directory verification, successful archive execution, or confirmation that the pull request branch belongs to the target repository. ### Attack Path 1. A contributor creates a branch in a fork using the same name as an existing unprotected branch in the target repository. 2. The pull request body includes a syntactically valid `OpenSpec change: ` marker. 3. A maintainer merges the pull request. 4. The `pull_request` closed event starts the archive workflow with repository write permission. 5. The cleanup step reads the fork's branch name from `head.ref`. 6. The command runs `git push origin --delete "$BRANCH"`, where `origin` points to the target repository. 7. The same-named target-repository branch is deleted if branch protection does not prevent it. ### Impact Assessment An attacker can cause deletion of an unprotected branch in the target repository after convincing a maintainer to merge the pull ...[truncated 304 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documented command explicitly runs claude --dangerously-skip-permissions in a background PTY with repo access, removing an important safety barrier before giving the tool broad autonomy to read files, inspect history, and act on the repository. In this skill's context, where artifacts may contain untrusted or adversarial content and the reviewer is instructed to explore the codebase independently, this materially increases the risk of unintended command execution, unsafe file access, or other side effects without human confirmation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: At L103 the documentation gives a clear directive: "Do not implement tasks directly. Delegate to Claude Code." However, L124 immediately states that for trivial changes, the orchestrator may implement directly instead. This is an active contradiction in the workflow guidance, not merely an omitted nuance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs launching Claude Code with --dangerously-skip-permissions and background execution to read artifacts, modify the repository, mark tasks complete, and commit changes, but it does not include an explicit safety warning, approval gate, or scope restriction. This meaningfully reduces runtime safeguards and could allow unintended or overbroad code changes, destructive repo actions, or abuse if task inputs, specs, or repository contents are adversarial.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented workflow automatically deletes the source branch of any merged pull request via git push origin --delete, but the surrounding guidance does not prominently warn users that enabling this action is destructive. In a reusable skill meant to be copied into repositories, this can remove branches that teams expected to retain for audit, backports, release tracking, or post-merge investigation, especially if branch protection is not configured.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The activation guidance says to review 'any artifact with real design decisions, trade-offs, or ambiguity' and skip only 'genuinely trivial artifacts,' which is subjective and broad. This lacks concrete trigger constraints or negative examples beyond a few examples, making it unclear when the protocol should and should not be invoked.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.