openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data ('contextFiles', 'context', and 'operationGuidance') returned by the 'openspec' CLI, which could theoretically contain malicious instructions.
- Ingestion points: The agent reads file paths provided in the 'contextFiles' array and interprets the 'context' and 'operationGuidance' fields from JSON command outputs.
- Boundary markers: The skill contains explicit instructions to treat 'context' as a prompt-level input but forbids copying it into code or planning artifacts. It also mandates that dynamic instructions cannot replace built-in state or bypass blocked states.
- Capability inventory: The skill is capable of reading local files, writing minimal code changes, and updating task statuses in markdown files.
- Sanitization: The instructions explicitly require the agent to report conflicts between dynamic input and the built-in workflow, acting as a manual validation step.
- [COMMAND_EXECUTION]: The skill executes shell commands via the 'openspec' CLI. Security is maintained through the 'allowed-tools' configuration in the frontmatter, which restricts the agent to the 'openspec' namespace, preventing the execution of arbitrary or malicious shell commands.
Audit Metadata