Is Fission-AI/OpenSpec safe?

No malicious indicators - review capabilities before installing

Notable — review in context (capabilities are not malware):

Node.js shell/command execution
Node.js filesystem read
Node.js filesystem write/delete

What to do: Nothing here argues against installing it. Grant the capabilities it lists only if you expect the tool to need them.

Fission-AI/OpenSpec is an npm package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators. It can: filesystem read, filesystem write, install time execution, network egress and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).

@fission-ai/openspec 1.14.1

npm_package · https://github.com/Fission-AI/OpenSpec

LOW

/ 100 risk score

Snapshot · scanned Oct 8, 2026 · @fission-ai/openspec@1.14.1 · engine 0.56.4 / ruleset 62

Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of Fission-AI/OpenSpec's authors. Report a false positive.

Capabilities — what this component can do (not a risk score):

filesystem readfilesystem writeinstall time executionnetwork egressshell execution

Behavioral traits

How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.

Execution authority

Tool Access Control / Direct Tool Access

Filesystem reach

Tool Execution Context

Network egress

Interaction & Communication / Direct Communication

Supply-chain provenance risk

General Protections / Supply Chain

Findings (5)

HIGHNode.js shell/command executionST-SHELL-NODE

The component can run operating-system commands or spawn processes.

build.js:3-3

import { execFileSync } from 'child_process';

scripts/pack-version-check.mjs:16-16

import spawn from 'cross-spawn';

src/commands/config.ts:1-1

import type { ChildProcess, spawn as nodeSpawn } from 'node:child_process';

src/commands/feedback.ts:1-1

import { execFileSync } from 'child_process';

src/commands/workset.ts:11-11

import type { spawn as nodeSpawn } from 'node:child_process';

src/commands/workset.ts:73-73

cachedSpawn = require('cross-spawn') as typeof nodeSpawn;

src/core/store/git.ts:1-1

import { execFile } from 'node:child_process';

src/core/store/operations.ts:1-1

import { execFile } from 'node:child_process';

src/core/version-check.ts:668-668

cachedSpawn = require('cross-spawn') as typeof import('child_process').spawn;

src/ui/welcome-screen.ts:10-10

} from 'node:child_process';

src/utils/shell-detection.ts:1-1

import { execFileSync } from 'node:child_process';

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

MEDIUMNode.js filesystem readST-FS-NODE-READ

The component reads files from disk.

src/commands/change.ts:166-166

const contentForTitle = await fs.readFile(proposalPath, 'utf-8');

src/commands/change.ts:185-185

const content = await fs.readFile(proposalPath, 'utf-8');

src/commands/change.ts:215-215

const deltaContent = await fs.readFile(deltaSpecPath, 'utf-8');

src/commands/change.ts:221-221

mainContent = await fs.readFile(mainSpecPath, 'utf-8');

src/commands/change.ts:454-454

const content = await fs.readFile(proposalPath, 'utf-8');

src/commands/change.ts:496-496

const content = await fs.readFile(proposalPath, 'utf-8');

src/commands/config.ts:363-363

const parsed: unknown = JSON.parse(fs.readFileSync(configPath, 'utf-8'));

src/commands/config.ts:531-531

const rawConfig = fs.readFileSync(configPath, 'utf-8');

src/commands/schema.ts:171-171

content = fs.readFileSync(schemaPath, 'utf-8');

src/commands/schema.ts:364-364

const contents = fs.readFileSync(abs);

src/commands/schema.ts:427-427

const originalContent = fs.readFileSync(configPath);

src/commands/schema.ts:475-475

fs.readFileSync(prepared.path).equals(prepared.originalContent)

src/commands/schema.ts:808-808

fs.readFileSync(path.join(trustedSourceDir, 'schema.yaml'), 'utf-8')

src/commands/schema.ts:870-870

const schemaContent = fs.readFileSync(stagedSchemaPath, 'utf-8');

src/commands/schema.ts:882-882

parseSchema(fs.readFileSync(stagedSchemaPath, 'utf-8'));

src/core/archive.ts:808-808

const contents = await fs.readFile(claimPath, 'utf8');

src/core/archive.ts:904-904

createHash('sha256').update(await fs.readFile(filePath)).digest('hex');

src/core/archive.ts:949-949

.update(await fs.readFile(filePath))

src/core/archive.ts:987-987

.update(await fs.readFile(filePath))

src/core/archive.ts:1090-1090

content = await fs.readFile(update.target);

src/core/archive.ts:1114-1114

...(stat.isFile() ? { content: await fs.readFile(update.target) } : {}),

src/core/archive.ts:1171-1171

(await fs.readFile(snapshot.target)).equals(snapshot.content);

src/core/archive.ts:1207-1207

const currentContent = await fs.readFile(snapshot.target);

src/core/archive.ts:1527-1527

const content = await fs.readFile(specFile, 'utf-8');

src/core/artifact-graph/instruction-loader.ts:253-253

return fs.readFileSync(fullPath, 'utf-8');

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

MEDIUMNode.js filesystem write/deleteST-FS-NODE-WRITE

The component writes or deletes files on disk.

src/commands/context.ts:143-143

fs.writeFileSync(resolved, buildCodeWorkspaceJson(workingSet, rootName));

src/commands/schema.ts:873-873

fs.writeFileSync(stagedSchemaPath, doc.toString());

src/commands/schema.ts:943-943

fs.rmSync(backupDir, { recursive: true, force: true });

src/commands/schema.ts:960-960

fs.rmSync(stagingDir, { recursive: true, force: true });

src/commands/schema.ts:1194-1194

fs.writeFileSync(

src/commands/schema.ts:1203-1203

fs.writeFileSync(templatePath, createDefaultTemplate(artifact.id));

src/commands/schema.ts:1224-1224

fs.writeFileSync(stagedConfigPath, preparedConfig.content);

src/commands/schema.ts:1283-1283

fs.rmSync(preparedConfig.path, { force: true });

src/commands/schema.ts:1293-1293

fs.rmSync(schemaDir, { recursive: true, force: true });

src/commands/schema.ts:1321-1321

fs.rmSync(backup, { recursive: true, force: true });

src/commands/schema.ts:1330-1330

fs.rmSync(schemaStagingDir, { recursive: true, force: true });

src/commands/schema.ts:1338-1338

fs.rmSync(configStagingDir, { recursive: true, force: true });

src/commands/workflow/new-change.ts:164-164

await fs.writeFile(readmePath, `# ${name}\n\n${options.description}\n`, 'utf-8');

src/core/archive.ts:627-627

await fs.rm(claimed, { force: true });

src/core/archive.ts:651-651

await fs.rm(dest, { recursive: true, force: true }).catch(() => undefined);

src/core/archive.ts:682-682

await fs.rm(dest, { recursive: true, force: true }).catch(() => undefined);

src/core/archive.ts:815-815

await fs.unlink(claimPath);

src/core/archive.ts:1229-1229

await fs.rm(snapshot.target, { force: true });

src/core/archive.ts:1244-1244

await fs.writeFile(snapshot.target, snapshot.content!);

src/core/archive.ts:1247-1247

await fs.rm(referent, { force: true });

src/core/archive.ts:1253-1253

await fs.writeFile(snapshot.target, snapshot.content);

src/core/completions/installers/bash-installer.ts:216-216

await fs.writeFile(bashrcPath, lines.join('\n'), 'utf-8');

src/core/completions/installers/bash-installer.ts:274-274

await fs.writeFile(targetPath, completionScript, 'utf-8');

src/core/completions/installers/bash-installer.ts:378-378

await fs.unlink(targetPath);

src/core/completions/installers/fish-installer.ts:107-107

await fs.writeFile(targetPath, completionScript, 'utf-8');

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

MEDIUMnpm prepare hookST-INSTALL-NPM-PREPARE

package.json has a 'prepare' script (runs on git/local installs and before publishing).

package.json:52-52

"prepare": "node build.js",

Why it matters: Usually a build step, but confirm it doesn't fetch or run remote code.

Fix: Usually a legitimate build step; confirm it only builds and does not fetch or execute remote code.

MEDIUMNode.js network egressST-NET-NODE

The component makes outbound network requests.

src/telemetry/index.ts:47-47

const response = await fetch(url, options);

website/cloudflare/router/worker.js:23-23

return fetch(request);

website/cloudflare/router/worker.js:52-52

const response = await fetch(upstream.toString(), init);

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

How attackers abuse these capabilities

Interactive labs on the attack class behind the rules above. They show the technique, not anything found in Fission-AI/OpenSpec.

Check your own component

Run the same evidence-backed scan on any MCP server, agent skill, or package.

Scan your own component

How we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →