openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external project artifacts to guide implementation tasks.
- Ingestion points: Project artifacts listed in
contextFiles(such as proposal, specs, design, and tasks) and JSON output from theopenspec instructions applycommand. - Boundary markers: The instructions explicitly direct the agent to report conflicts between the built-in instructions and project context, and caution against using external guidance as proof of completion.
- Capability inventory: The skill utilizes
Bash(openspec:*)to perform status checks and update task checkboxes, and it is designed to perform code edits in the local filesystem based on task descriptions. - Sanitization: The skill mandates checking task checkboxes at specific source paths and lines to ensure consistency, though it does not explicitly mention sanitization of the content before it is processed by the LLM.
Audit Metadata