openspec-apply
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external files to determine its execution flow, creating a risk where malicious instructions inside those files could be obeyed by the agent.
- Ingestion points: The skill instructions direct the agent to read content from
changes/<id>/proposal.md,design.md, andtasks.md(as specified in the Steps section ofSKILL.md). - Boundary markers: There are no explicit boundary markers or instructions to treat the content of the read files as untrusted data or to disregard embedded instructions.
- Capability inventory: The skill has access to powerful tools including
Bash,Write,Edit, andTask(listed in theallowed-toolsfrontmatter), which allow for arbitrary command execution and file system changes. - Sanitization: No evidence of sanitization, validation, or escaping of the content read from the external files before it influences the agent's actions.
Audit Metadata