openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from an OpenSpec repository, including specifications, task descriptions, project context, and operation guidance. * Ingestion points: The agent is instructed to read contextFiles (such as proposal, specs, design, and tasks) and process context and operationGuidance fields returned by the openspec CLI tool in SKILL.md. * Boundary markers: There are no explicit delimiters or warnings provided to the agent to distinguish between administrative instructions and content from untrusted files. * Capability inventory: The agent has the ability to modify the local file system to implement code changes and update task status files as described in the 'Implement tasks' section of SKILL.md. * Sanitization: No sanitization or validation of the content within the OpenSpec files is performed before the agent 'applies' the facts and constraints found within them.
Audit Metadata