openspec-apply
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface due to the ingestion of untrusted local data coupled with high-privilege capabilities.
- Ingestion points: The workflow requires reading
tasks.md,design.md, files within thespecs/directory, and existing source code files. - Boundary markers: There are no instructions for the agent to use delimiters or ignore embedded instructions when reading these project artifacts.
- Capability inventory: The skill allows the agent to create new files, modify existing code, and execute tests via the command line.
- Sanitization: No validation, filtering, or sanitization steps are defined for the content extracted from the markdown specifications or task lists.
Audit Metadata