openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and follow instructions embedded within the data it processes from the local project environment.
- Ingestion points: The skill executes
openspec instructions applywhich returns JSON fields namedcontextandoperationGuidance. These fields contain project-specific facts and advisory guidance that the agent is instructed to follow. - Boundary markers: The skill explicitly instructs the agent to treat these inputs as separate from the CLI-returned state, ensuring they do not permit bypassing blocked states or replace built-in instructions.
- Capability inventory: The skill uses
Bash(openspec:*)to execute commands and has the ability to read project files and update task checkboxes in markdown artifacts. - Sanitization: The instructions include a requirement for the agent to report conflicts if the project-provided
contextorguidancecontradicts the core workflow or user choices. - [COMMAND_EXECUTION]: The skill heavily relies on executing the
openspecCLI tool with various subcommands (status,instructions,list,store list). Arguments such as--changeand--storeare dynamically populated based on user input or inferred from the conversation context.
Audit Metadata