openspec-plus-design Audit report.

Warnings

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• Financial research output is not financial advice; require human review before any live investment decision
• The SKILL.md excerpt appears incomplete: the Phase 0 explanation cuts off mid-sentence, and there is no explicit 'Limitations' section covering unsupported OpenSpec versions or CLI unavailability.
• The skill does not explicitly warn the agent to treat design documents, proposals, and project instruction files as data rather than executable instructions, which could create prompt-injection risk in adversarial repositories.
• The red flag 'Reviewer flagged minor issues, I'll re-dispatch after fixing to confirm' is ambiguous; it could discourage legitimate re-review after fixes.
• The workflow is deliberately rigid and may be heavyweight for very small changes, though the skill does attempt to address this with red flags and principles.
• Financial research output is not financial advice; require human review before any live investment decision.
• Quality score needs review
• Permission surface needs review: secrets or environment access, shell or command execution
• Stars/forks activity: 167 stars, 9 forks; issue activity unavailable in current metadata
• Dependency/runtime risk: command execution surface, credential or environment access

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.