openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that ingests task definitions and project context from external files, creating a potential surface for instructions embedded in that data to influence agent behavior.
- Ingestion points: The agent parses the output of
openspec statusandopenspec instructions apply, and reads files listed in thecontextFilesarray from SKILL.md. - Boundary markers: The instructions explicitly direct the agent to separate CLI-controlled state from advisory context and to prioritize the built-in workflow logic when conflicts between inputs are detected.
- Capability inventory: The skill allows the agent to read local project files, modify source code, update task statuses in markdown files, and execute commands via the
openspecCLI. - Sanitization: The skill contains explicit guardrails prohibiting the verbatim copying of runtime context or guidance into implementation files or planning artifacts, mitigating the risk of persistent data poisoning.
Audit Metadata