openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external project data through the
openspecCLI, specifically thecontextandoperationGuidancefields returned by commands. This introduces a potential surface for indirect prompt injection if those project-level artifacts contain malicious instructions. - Ingestion points: Data is loaded from the output of
openspec statusandopenspec instructions apply(SKILL.md). - Boundary markers: The skill provides explicit instructions to the agent to maintain a boundary between this external data and the controlling workflow logic. It states that this data does not replace built-in instructions and cannot be used to bypass state checks (SKILL.md).
- Capability inventory: The agent has the capability to read project files, write code changes, and update task tracking files using the
Bash(openspec:*)toolset (SKILL.md). - Sanitization: The instructions mandate that the agent must report conflicts between external context and CLI-controlled values, and must not copy this data verbatim into implementation files unless specifically requested (SKILL.md).
Audit Metadata