openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes task descriptions, project context, and operational guidance retrieved from the openspec CLI. These external inputs influence agent behavior, including code modifications and task status updates. Ingestion points: Data retrieved from openspec status and openspec instructions output in SKILL.md. Boundary markers: The instructions explicitly tell the agent to keep context and operationGuidance separate from core workflow instructions and to report conflicts. Capability inventory: The agent can execute openspec bash commands and perform file modifications to implement tasks. Sanitization: The skill includes instructions for the agent to identify and report conflicts between external guidance and the built-in workflow.
- [COMMAND_EXECUTION]: The skill dynamically constructs shell commands using user-provided strings for change name and store ID (e.g., openspec status --change ""). While the allowed-tools frontmatter restricts execution to the openspec namespace, malicious input could potentially be used to inject additional arguments to the tool.
Audit Metadata