implement-openspec-changes
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill orchestrates a multi-step pipeline (Apply, Verify, Fix, Review, Commit) where subagents ingest data from external sources to perform automated code fixes. This creates a surface where instructions embedded in the data being processed could influence the subagents' behavior.
- Ingestion points: The pipeline processes change definitions located in
openspec/changes/and output reports from external tools likeopenspec-verify-changeandgoodreviewas specified inSKILL.md. - Capability inventory: The skill and its subagents have the capability to write to the file system (Steps 1, 3, 5) and perform git commits (Step 6).
- Boundary markers: The instructions in
SKILL.mddo not define explicit delimiters or security warnings to the subagents regarding the potentially untrusted nature of the content in the change files or generated reports. - Sanitization: There is no evidence of sanitization, filtering, or validation logic for the content of the OpenSpec changes or tool reports before they are utilized by subagents to direct code modifications.
Audit Metadata