openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content from project files and CLI outputs (specifically the 'context' and 'operationGuidance' fields from 'openspec instructions apply') to drive implementation tasks, creating an attack surface where instructions embedded in project artifacts could influence agent behavior.
- Ingestion points: CLI JSON output and project files identified in 'contextFiles'.
- Boundary markers: The skill lacks explicit delimiters or boundary markers for the ingested content, though it instructs the agent to manually identify conflicts.
- Capability inventory: The skill is capable of executing shell commands via the 'openspec' CLI and performing file system modifications (implementing code changes and updating task lists).
- Sanitization: No structural sanitization, escaping, or schema validation of the ingested external content is specified.
Audit Metadata