openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external files and CLI outputs that could contain malicious instructions meant to override agent behavior.
- Ingestion points: Data is read from files listed in the
contextFilesarray and from thecontextandoperationGuidancefields of the JSON output fromopenspec instructions apply. - Boundary markers: The skill includes explicit instructions for the agent to treat external guidance as advisory only, to keep it separate from the functional state (such as task completion criteria), and to report conflicts.
- Capability inventory: The agent is authorized to execute
openspecCLI commands and modify project files to implement tasks, providing a potential impact path for successful injections. - Sanitization: The skill relies on logic-based guardrails within the prompt rather than technical sanitization or input validation to manage untrusted data.
Audit Metadata