openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests
contextandoperationGuidancefields from theopenspecCLI output and instructs the agent to follow them as behavior contracts. This creates a surface where malicious project data could inject instructions into the agent's workflow. \n- Ingestion points: Output ofopenspec instructions apply --jsonin Step 3. \n- Boundary markers: The skill tells the agent to report conflicts and keep guidance separate, but no formal delimiters are used. \n- Capability inventory: Access toopenspecCLI commands and local file modification for implementing tasks. \n- Sanitization: Relies on the agent to detect malicious input rather than using programmatic validation.
Audit Metadata