openspec-apply-change

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and follow instructions embedded within the data it processes from the local project environment.
  • Ingestion points: The skill executes openspec instructions apply which returns JSON fields named context and operationGuidance. These fields contain project-specific facts and advisory guidance that the agent is instructed to follow.
  • Boundary markers: The skill explicitly instructs the agent to treat these inputs as separate from the CLI-returned state, ensuring they do not permit bypassing blocked states or replace built-in instructions.
  • Capability inventory: The skill uses Bash(openspec:*) to execute commands and has the ability to read project files and update task checkboxes in markdown artifacts.
  • Sanitization: The instructions include a requirement for the agent to report conflicts if the project-provided context or guidance contradicts the core workflow or user choices.
  • [COMMAND_EXECUTION]: The skill heavily relies on executing the openspec CLI tool with various subcommands (status, instructions, list, store list). Arguments such as --change and --store are dynamically populated based on user input or inferred from the conversation context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 06:57 AM