openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and acts upon content from external context files such as proposals, specifications, designs, and task lists, which could contain malicious instructions designed to manipulate the agent behavior. Ingestion points: The skill reads file paths dynamically returned by the openspec CLI tool (SKILL.md, Step 4). Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the content of these files strictly as data. Capability inventory: The skill utilizes the openspec CLI bash tool and performs file modifications to implement tasks. Sanitization: There is no evidence of sanitization, filtering, or validation of the content read from the context files.
Audit Metadata