openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the openspec tool's output, specifically the context and operationGuidance fields, as well as the contents of files listed in contextFiles. This data could be manipulated by an attacker who influences the OpenSpec repository to inject malicious instructions into the agent's context.
- Ingestion points: The agent parses JSON output from openspec instructions apply and reads files identified by the tool (SKILL.md).
- Boundary markers: The skill provides explicit instructions to the agent to treat context and operationGuidance as separate from controlling logic and to report conflicts with built-in instructions (SKILL.md).
- Capability inventory: The agent has access to the Bash(openspec:*) toolset and file system capabilities (SKILL.md).
- Sanitization: The skill relies on natural language instructions for the agent to validate and prioritize built-in controls over external guidance, which is a soft mitigation.
Audit Metadata