openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that consumes untrusted data from CLI outputs to direct agent behavior, which creates a vulnerability to prompt injection if the processed content is malicious.
- Ingestion points: The skill instructions specifically direct the agent to parse and act upon the
contextandoperationGuidancefields returned by theopenspec instructions apply --jsoncommand (SKILL.md). - Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" warnings for the content ingested from the CLI, increasing the likelihood that the agent will follow instructions embedded within the data.
- Capability inventory: The agent has permissions to execute
openspecshell commands and write to local markdown files to update task progress (SKILL.md). - Sanitization: There is no requirement or logic provided to sanitize or validate the content of the
contextoroperationGuidancefields before they are incorporated into the agent's decision-making process.
Audit Metadata