openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources that are not strictly controlled, which could be exploited to influence agent behavior.\n
- Ingestion points: The agent reads JSON output from commands like
openspec statusandopenspec instructions apply, as well as the content of files specified in thecontextFilesfield (e.g., specs, designs, tasks).\n - Boundary markers: The instructions provide explicit guidance to the agent to treat external
contextandoperationGuidanceas separate from core workflow logic and to report conflicts rather than blindly following them.\n - Capability inventory: The skill possesses the ability to execute shell commands via the
openspectool and modify local project files (e.g., updating task checkboxes).\n - Sanitization: The skill instructs the agent to preserve CLI-controlled values and report any discrepancies between project context and built-in instructions, serving as a procedural safeguard.\n- [COMMAND_EXECUTION]: The skill relies on the execution of the
openspecCLI tool via shell commands (e.g.,openspec status,openspec instructions,openspec list). While this is the intended functionality, it involves running a specialized external binary with arguments derived from the environment and user input.
Audit Metadata