openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to instructions embedded in data processed at runtime.
- Ingestion points: Data enters the agent context through the
contextandoperationGuidancefields returned by theopenspec instructions applycommand inSKILL.md(Step 3). - Boundary markers: The skill attempts to define boundaries by instructing the agent to "Keep both fields separate from CLI-returned state" and to "report the conflict and preserve the controlling value" if conflicts with the built-in workflow occur.
- Capability inventory: The skill possesses the ability to execute scoped shell commands via
openspecand can read and write to the local file system (Step 6). - Sanitization: No explicit sanitization or filtering is performed on the externally provided
contextoroperationGuidancefields before they are integrated into the agent's reasoning process.
Audit Metadata