openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands using the
openspecCLI (e.g.,openspec list,openspec status,openspec instructions). These commands are used to retrieve JSON metadata and manage the state of code changes within a project repository. - [DATA_EXFILTRATION]: The skill reads project-related files (proposals, specs, design, tasks) to provide context for implementation. While it accesses these files, it lacks instructions to transmit this data to external or untrusted domains.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted data from project files. 1. Ingestion points: Project files such as proposals, specifications, and task lists identified by the CLI's
contextFilesoutput. 2. Boundary markers: The skill does not explicitly define markers to separate external data from its own instructional context. 3. Capability inventory: The skill has the capability to modify source code, update task status in markdown files, and execute shell commands through theopenspecbinary. 4. Sanitization: There is no explicit requirement for the agent to sanitize or validate the content of the project files before acting on implementation instructions.
Audit Metadata