openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill dynamically generates shell commands using user-provided values for change names and store identifiers (e.g.,
openspec status --change "<name>"). Although command execution is restricted to theopenspecCLI, the inclusion of unvalidated user input in shell strings presents a potential surface for command injection. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon instructions returned by external CLI commands, which constitutes an indirect prompt injection surface.
- Ingestion points: The agent reads the
context,operationGuidance, andcontextFilesfields from the JSON output of theopenspec instructions applycommand (SKILL.md, steps 3 and 4). - Boundary markers: The skill includes instructions to separate this external guidance from the agent's core state and to preserve the authority of built-in CLI-controlled values.
- Capability inventory: The skill has the capability to execute
openspeccommands and perform file system writes to implement code changes and update task statuses. - Sanitization: The instructions explicitly warn the agent not to follow guidance that conflicts with controlling inputs and to avoid copying runtime context into planning artifacts.
Audit Metadata