openspec-apply
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads and follows instructions from project files like proposal.md, tasks.md, and specs/*.md. Maliciously crafted specifications in a shared repository could influence agent behavior.\n
- Ingestion points: openspec/project.md, openspec/changes/{change-id}/proposal.md, openspec/changes/{change-id}/tasks.md, openspec/changes/{change-id}/specs/*.md, and the project's CLAUDE.md file.\n
- Boundary markers: Absent. The agent is instructed to follow the implementation checklist directly without explicit constraints against embedded instructions.\n
- Capability inventory: The skill has access to Bash for command execution and Write/Edit tools for file system modifications.\n
- Sanitization: Absent. Content from the markdown files is processed directly as implementation instructions.\n- [COMMAND_EXECUTION]: The skill executes local shell commands for version control (git) and project maintenance tasks like linting and testing (make, npm) using the project's local environment and configuration files.
Audit Metadata