openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act on external data from the
openspecCLI, which creates a potential surface for indirect prompt injection if the tool output is compromised. - Ingestion points: The skill parses JSON data returned by
openspec status --change "<name>" --jsonandopenspec instructions apply --change "<name>" --jsonto identify tasks and files. - Boundary markers: There are no explicit boundary markers or delimiters defined in the instructions to separate the data returned by the CLI from the agent's instructions, though it does warn against copying guidance verbatim.
- Capability inventory: The skill possesses significant capabilities, including modifying arbitrary files identified in the context and executing shell commands via the
openspectool. - Sanitization: The skill lacks sanitization, validation, or filtering for the
context,operationGuidance, orinstructionfields retrieved from the CLI output before using them to drive implementation. - [COMMAND_EXECUTION]: The skill relies on the execution of multiple subcommands of the
openspecCLI (status,list,instructions,store) to manage the implementation workflow.
Audit Metadata