openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted data from the 'context' and 'operationGuidance' fields of the CLI output, which is designed to influence agent behavior. (1) Ingestion points: JSON output from 'openspec instructions apply --json' parsed in SKILL.md. (2) Boundary markers: The instructions explicitly command the agent to treat these as advisory only, report any conflicts with core instructions, and ignore them if they indicate task completion or bypass blocked states. (3) Capability inventory: The skill uses the Bash tool to run the openspec CLI and has the capability to read and modify project files. (4) Sanitization: The agent is instructed to validate guidance against built-in instructions and CLI-controlled values.
- [COMMAND_EXECUTION]: The skill executes shell commands using the openspec CLI through the Bash tool. It dynamically interpolates variables such as change names and store IDs into these commands, which presents a surface for potential command injection if inputs are not properly sanitized by the underlying platform, although the risk is limited by a tool-call restriction that scopes Bash usage to the openspec binary.
Audit Metadata