openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands via the
openspecCLI tool to manage change implementation. It interpolates user-provided or inferred variables into commands, such asopenspec status --change "<name>" --jsonandopenspec instructions apply --change "<name>" --json. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external project artifacts like specification documents and task lists, which could contain instructions designed to override agent behavior.
- Ingestion points: Data is read from files identified in the
contextFileslist provided by the CLI (SKILL.md Step 4). - Boundary markers: The instructions do not define delimiters or specific constraints to prevent the agent from following instructions embedded within the data files.
- Capability inventory: The agent can read files, write to files to mark tasks as complete, and execute shell commands through the
openspecutility. - Sanitization: There is no evidence of sanitization or content filtering for the data ingested from the repository files.
Audit Metadata