openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill uses natural instructional language to guide the AI through a specific technical workflow. There are no attempts to override safety filters, extract system prompts, or bypass agent constraints.
- [DATA_EXFILTRATION]: No network operations or commands like curl or wget are present. The skill operates on local project files within the 'openspec/' directory and registered stores, which is expected for its functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill processes JSON output and project files defined by the CLI. It includes specific guardrails (ingestion point: 'context' and 'contextFiles' in SKILL.md; boundaries: 'Keep both fields separate from CLI-returned state') that instruct the AI to prioritize CLI state over provided guidance, effectively mitigating the risk of malicious instructions in external data.
- [COMMAND_EXECUTION]: The skill invokes the 'openspec' CLI tool for legitimate workflow operations such as listing changes, checking status, and reading instructions. These commands are scoped to the primary purpose of the skill.
Audit Metadata