openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by processing external data as behavioral instructions. \n
- Ingestion points: The skill reads data from the
contextandoperationGuidancefields produced by theopenspecCLI tool, and it ingests the content of local files listed in thecontextFilesoutput. \n - Boundary markers: While the skill instructs the agent to treat these fields as separate from CLI-controlled state and report conflicts, it explicitly defines them as "prompt-level behavior contracts" and "required prompt-level input," increasing the likelihood the agent will obey embedded instructions. \n
- Capability inventory: The skill has the ability to read local files, execute the
openspecCLI tool, and modify task-related files on the filesystem. \n - Sanitization: No sanitization, validation, or schema enforcement is mentioned for the content retrieved from the CLI output or the context files. \n- [COMMAND_EXECUTION]: The skill relies on the execution of the
openspecCLI tool. It dynamically constructs commands using parameters like change names and store IDs, which are derived from user input or conversation context.
Audit Metadata