openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data (task descriptions, project context, and guidance) from the openspec CLI tool, which could be influenced by external project files. The skill includes robust defensive instructions to treat this data as advisory and prevents it from overriding core state logic.
- Ingestion points: Data enters the context through openspec status and openspec instructions apply commands in SKILL.md.
- Boundary markers: The instructions explicitly define external context as a 'prompt-level behavior contract' and mandate that it must not be used as evidence of task completion or to bypass blocks.
- Capability inventory: The skill uses a scoped openspec Bash tool and performs local file read/write operations for task implementation.
- Sanitization: The agent is directed to report conflicts between external data and core workflow instructions, ensuring the primary instructions maintain control.
Audit Metadata