openspec-apply-change
Fail
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell command templates (e.g.,
openspec status --change "<name>" --json) that interpolate a<name>variable. This variable is often derived directly from user input. If the agent does not properly sanitize this input, an attacker could use shell metacharacters to execute arbitrary commands on the system. - [PROMPT_INJECTION]: The skill identifies an attack surface for indirect prompt injection (Category 8) by processing untrusted data.
- Ingestion points: Reads multiple local files specified in the
contextFilesoutput of the CLI. - Boundary markers: Absent. The skill does not instruct the agent to use delimiters or ignore embedded instructions within these files.
- Capability inventory: The skill allows file reading, file modification (writing code and updating tasks), and execution of CLI tools.
- Sanitization: Absent. There is no evidence of content validation or filtering before processing the contents of the context files.
Recommendations
- AI detected serious security threats
Audit Metadata