openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various openspec CLI commands such as status, list, and instructions using the Bash tool to manage workflow state and project metadata.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project files and CLI outputs, specifically the context and operationGuidance fields, which could potentially contain malicious instructions.
- Ingestion points: Files listed in contextFiles and JSON responses from openspec instructions are processed by the agent within the SKILL.md instructions.
- Boundary markers: The instructions explicitly state that context and operationGuidance should not be used to bypass blocked states or replace built-in instructions.
- Capability inventory: The skill has the ability to execute openspec CLI commands and modify local files, such as marking checkboxes in task files.
- Sanitization: The skill includes defensive logic to report conflicts between project context and CLI-controlled values, preserving the controlling value rather than executing based on untrusted guidance.
Audit Metadata