openspec-plus-apply
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill identifies and runs lint, format, and test commands derived from project configuration files (e.g.,
package.json,Cargo.toml,go.mod) and documentation (e.g.,AGENTS.md). It also utilizesgitcommands (git log,git diff) to validate files and review changes. - [INDIRECT_PROMPT_INJECTION]: The skill processes external, user-supplied artifacts including
proposal.md,spec.md,design.md, andtasks.md. The content of these files is interpolated into prompts for implementer and reviewer subagents. - Ingestion points: Artifacts such as
proposal.md,spec.md,design.md, andtasks.mdare ingested into the main agent's context during the workflow defined inSKILL.md. - Boundary markers: The skill uses explicit prompt templates (
implementer-prompt.md,spec-compliance-reviewer-prompt.md, etc.) to structure subagent tasks, though it does not provide specific instructions to ignore potentially malicious instructions embedded within the artifact content. - Capability inventory: The skill possesses the capability to execute shell commands (git, lint, test tools) and perform file system operations (reading source files, updating
tasks.md). - Sanitization: No explicit sanitization, validation, or filtering of the artifact data is performed before it is passed to subagents.
Audit Metadata