open-spec-apply
Pass
Audited by Gen Agent Trust Hub on Apr 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by processing external task descriptions and design artifacts to drive code modifications.
- Ingestion points: Reads content from 'specs/changes//' including proposal.md, design.md, and tasks.md (SKILL.md).
- Boundary markers: Absent. The instructions do not specify any delimiters or safety warnings to distinguish between task data and agent instructions.
- Capability inventory: The agent is authorized to 'Make the code changes required' (SKILL.md), which involves broad file-writing capabilities across the codebase.
- Sanitization: Absent. There is no mention of validating or escaping the content read from the specification files before using it to guide implementation.
Audit Metadata