openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external project files and CLI outputs, which constitutes a potential attack surface.
- Ingestion points: The agent reads project-specific context and advisory guidance from the 'context' and 'operationGuidance' fields of the 'openspec instructions apply' command output, as well as file content from paths listed in 'contextFiles' (SKILL.md).
- Boundary markers: The skill provides explicit instructions to the agent to treat external guidance as optional and to preserve CLI-controlled state, effectively creating a logical boundary between untrusted data and core workflow logic.
- Capability inventory: The skill uses the Bash tool to execute 'openspec' commands and modifies local task files to track progress.
- Sanitization: While no specific string sanitization is used, the skill implements behavioral guardrails to prevent external input from bypassing blocked states or completion criteria.
Audit Metadata